From 3a873432950a92454081578e762d5e0739cfbdc1 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 10:28:03 +0200 Subject: [PATCH 01/11] Fix broken link - replace '../usage/import-automated.md by '../usage/getting-started --- docs/deployment/managers.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/deployment/managers.md b/docs/deployment/managers.md index a6f6c57b..854681de 100644 --- a/docs/deployment/managers.md +++ b/docs/deployment/managers.md @@ -58,7 +58,7 @@ More information can be found [here](../usage/notifications.md). The ingestion manager in OpenCTI is a component that manages the ingestion of data from RSS, TAXII and CSV feeds. -More information can be found [here](../usage/import-automated.md). +More information can be found [here](../usage/getting-started.md). ## Playbook manager @@ -87,4 +87,4 @@ The trash manager is responsible to delete permanently elements stored in the [t The telemetry manager collects periodically statistical data about platform usage. -More information about data telemetry can be found [here](../reference/usage-telemetry.md). \ No newline at end of file +More information about data telemetry can be found [here](../reference/usage-telemetry.md). From 0ad93af84e9ba8eac96133102fc4497a0aba1b71 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 10:32:24 +0200 Subject: [PATCH 02/11] Replace broken link replace import-automated.md with getting-started.md --- docs/usage/feeds.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/usage/feeds.md b/docs/usage/feeds.md index 287fe8f8..f14e32e3 100644 --- a/docs/usage/feeds.md +++ b/docs/usage/feeds.md @@ -51,7 +51,7 @@ Given a live stream with filters *Entity type: Indicator* `AND` *Label: detectio | 4. Add the label `detection` | Create the indicator | Create the indicator, create the relationship `indicates` | | 5. Delete the indicator | Delete the indicator | Delete the indicator and the relationship | -Details on how to consume these Live streams can be found on [the dedicated page](import-automated.md). +Details on how to consume these Live streams can be found on [the dedicated page](getting-started.md). ## TAXII Collections From 7d557ec1c064eb3dda796a6899208fc39d726a96 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 10:46:09 +0200 Subject: [PATCH 03/11] Fix csv-mapper broken link Added a ! in front of [csv-ampper](../administration/csv-mappers.md) to ensure the link is not broken --- docs/usage/import/csv-feed.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/usage/import/csv-feed.md b/docs/usage/import/csv-feed.md index 5d8b1906..585dd388 100644 --- a/docs/usage/import/csv-feed.md +++ b/docs/usage/import/csv-feed.md @@ -31,7 +31,7 @@ Here's a step-by-step guide to configure Csv Feeds: !!! note "CSV mapper" - CSV feed functionality is based on CSV mappers. It is necessary to create the appropriate CSV mapper to import the data contained in the file. See the page dedicated to the [CSV mapper](../administration/csv-mappers.md). + CSV feed functionality is based on CSV mappers. It is necessary to create the appropriate CSV mapper to import the data contained in the file. See the page dedicated to the ![CSV mapper](../administration/csv-mappers.md). Additional configuration options: @@ -110,4 +110,4 @@ Within a few seconds, you'll be directed to your newly created CSV Feed. _Make sure you have the capability to create a CSV Feed on OpenCTI_ -![1Click CSV Feed button](../assets/one-click-deploy.png) \ No newline at end of file +![1Click CSV Feed button](../assets/one-click-deploy.png) From 4fe74399c195f099fc0e73af0c8b1377c5aa26e2 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:02:27 +0200 Subject: [PATCH 04/11] Update external-connectors.md add "!" in front of [List of capabilities](../administration/users.md#list-of-capabilities) to ensure link is working --- docs/usage/import/external-connectors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/usage/import/external-connectors.md b/docs/usage/import/external-connectors.md index 2e6d972a..0976177d 100644 --- a/docs/usage/import/external-connectors.md +++ b/docs/usage/import/external-connectors.md @@ -13,7 +13,7 @@ The level of configuration granularity regarding the imported data type varies w Resetting the connector state enables you to restart the ingestion process from the very beginning. Additionally, resetting the connector state will purge the RabbitMQ queue for this specific connector. -However, this action requires the "Manage connector state" capability (more details about capabilities: [List of capabilities](../administration/users.md#list-of-capabilities)). Without this specific capability, you will not be able to reset the connector state. +However, this action requires the "Manage connector state" capability (more details about capabilities: ![List of capabilities](../administration/users.md#list-of-capabilities)). Without this specific capability, you will not be able to reset the connector state. When the action is performed, a message is displayed confirming the reset and inform you about the number of messages that will be purged From 6c52c480fdd75515f90e9a6e0a3672aa89ad0677 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:04:36 +0200 Subject: [PATCH 05/11] Fix all broken links add a ! in front of all broken links to ensure links are working --- docs/usage/import/external-connectors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/usage/import/external-connectors.md b/docs/usage/import/external-connectors.md index 0976177d..3a4c2bdb 100644 --- a/docs/usage/import/external-connectors.md +++ b/docs/usage/import/external-connectors.md @@ -25,6 +25,6 @@ By purging the queue, you ensure that the connector starts with a clean slate, p ### Connector Ecosystem -OpenCTI's connector ecosystem covers a broad spectrum of sources, enhancing the platform's capability to integrate data from various contexts, from threat intelligence providers to specialized databases. The list of available connectors can be found in our [connectors catalog](https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76#c94bf651e08146c4855a25efeaabc574). Connectors are categorized into three types: import connectors (the focus here), [enrichment connectors](enrichment.md), and stream consumers. Further documentation on connectors is available on [the dedicated documentation page](../deployment/connectors.md). +OpenCTI's connector ecosystem covers a broad spectrum of sources, enhancing the platform's capability to integrate data from various contexts, from threat intelligence providers to specialized databases. The list of available connectors can be found in our ![connectors catalog](https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76#c94bf651e08146c4855a25efeaabc574). Connectors are categorized into three types: import connectors (the focus here), ![enrichment connectors](enrichment.md), and stream consumers. Further documentation on connectors is available on ![the dedicated documentation page](../deployment/connectors.md). In summary, automated imports through connectors empower OpenCTI users with a scalable, efficient, and customizable mechanism for data ingestion, ensuring that the platform remains enriched with the latest and most relevant intelligence. From 17fe8bf96ce4b7183e767b0964a0a44604650269 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:39:52 +0200 Subject: [PATCH 06/11] Replace file path to ensure link pointing tot he right file add ../ in the link ../adminstration/csv-mappers.md (new one ../ ../adminstration/csv-mappers.md) to ensure the file path is correct --- docs/usage/import/csv-feed.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/usage/import/csv-feed.md b/docs/usage/import/csv-feed.md index 585dd388..75b7f41b 100644 --- a/docs/usage/import/csv-feed.md +++ b/docs/usage/import/csv-feed.md @@ -31,7 +31,7 @@ Here's a step-by-step guide to configure Csv Feeds: !!! note "CSV mapper" - CSV feed functionality is based on CSV mappers. It is necessary to create the appropriate CSV mapper to import the data contained in the file. See the page dedicated to the ![CSV mapper](../administration/csv-mappers.md). + CSV feed functionality is based on CSV mappers. It is necessary to create the appropriate CSV mapper to import the data contained in the file. See the page dedicated to the [CSV mapper](../../administration/csv-mappers.md). Additional configuration options: From 8a530b7539eddea0afb7cdcef4e6104f65e07f3a Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:41:37 +0200 Subject: [PATCH 07/11] Fix file path for the links to ensure correct retrievial of pages --- docs/usage/import/external-connectors.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/usage/import/external-connectors.md b/docs/usage/import/external-connectors.md index 3a4c2bdb..c0b9500d 100644 --- a/docs/usage/import/external-connectors.md +++ b/docs/usage/import/external-connectors.md @@ -13,7 +13,7 @@ The level of configuration granularity regarding the imported data type varies w Resetting the connector state enables you to restart the ingestion process from the very beginning. Additionally, resetting the connector state will purge the RabbitMQ queue for this specific connector. -However, this action requires the "Manage connector state" capability (more details about capabilities: ![List of capabilities](../administration/users.md#list-of-capabilities)). Without this specific capability, you will not be able to reset the connector state. +However, this action requires the "Manage connector state" capability (more details about capabilities: [List of capabilities](../../administration/users.md#list-of-capabilities)). Without this specific capability, you will not be able to reset the connector state. When the action is performed, a message is displayed confirming the reset and inform you about the number of messages that will be purged @@ -25,6 +25,6 @@ By purging the queue, you ensure that the connector starts with a clean slate, p ### Connector Ecosystem -OpenCTI's connector ecosystem covers a broad spectrum of sources, enhancing the platform's capability to integrate data from various contexts, from threat intelligence providers to specialized databases. The list of available connectors can be found in our ![connectors catalog](https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76#c94bf651e08146c4855a25efeaabc574). Connectors are categorized into three types: import connectors (the focus here), ![enrichment connectors](enrichment.md), and stream consumers. Further documentation on connectors is available on ![the dedicated documentation page](../deployment/connectors.md). +OpenCTI's connector ecosystem covers a broad spectrum of sources, enhancing the platform's capability to integrate data from various contexts, from threat intelligence providers to specialized databases. The list of available connectors can be found in our [connectors catalog](https://filigran.notion.site/OpenCTI-Ecosystem-868329e9fb734fca89692b2ed6087e76#c94bf651e08146c4855a25efeaabc574). Connectors are categorized into three types: import connectors (the focus here), [enrichment connectors](../enrichment.md), and stream consumers. Further documentation on connectors is available on ![the dedicated documentation page](../../deployment/connectors.md). In summary, automated imports through connectors empower OpenCTI users with a scalable, efficient, and customizable mechanism for data ingestion, ensuring that the platform remains enriched with the latest and most relevant intelligence. From 3f2d8e01706549dd505cd600431a9d5c70724cf2 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:44:36 +0200 Subject: [PATCH 08/11] Fix file path to ensure broken link is not broken --- docs/usage/import/internal-streams.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/usage/import/internal-streams.md b/docs/usage/import/internal-streams.md index 96931b71..00bc81cb 100644 --- a/docs/usage/import/internal-streams.md +++ b/docs/usage/import/internal-streams.md @@ -27,11 +27,11 @@ Live Streams enable users to consume data from another OpenCTI platform, fosteri Additional configuration options: -- User responsible for data creation: Define the user responsible for creating data received from this stream. Best practice is to dedicate one user per source for organizational clarity. Please [see the section "Best practices" below](import-automated.md#best-practices-section) for more information. +- User responsible for data creation: Define the user responsible for creating data received from this stream. Best practice is to dedicate one user per source for organizational clarity. Please [see the section "Best practices" below](../getting-started.md) for more information. - Starting synchronization: Specify the date of the oldest data to retrieve. Leave the field empty to import everything. - Take deletions into account: Enable this option to delete data from your platform if it was deleted on the providing stream. (Note: Data won't be deleted if another source has imported it previously.) - Verify SSL certificate: Check the validity of the certificate of the domain hosting the remote platform. - Avoid dependencies resolution: Import only entities without their relationships. For instance, if the stream shares malware, all the malware's relationships will be retrieved by default. This option enables you to choose not to recover them. - Use perfect synchronization: This option is specifically for synchronizing two platforms. If an imported entity already exists on the platform, the one from the stream will overwrite it. -![Live stream additional configuration](../assets/live-stream-additional-configuration.png) \ No newline at end of file +![Live stream additional configuration](../assets/live-stream-additional-configuration.png) From 2ad15d899162afb19365d8f37e497ca39127df71 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:46:39 +0200 Subject: [PATCH 09/11] Update file path to ensure no broken links --- docs/usage/import/rss-feed.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/usage/import/rss-feed.md b/docs/usage/import/rss-feed.md index 7bc968cc..5cb68314 100644 --- a/docs/usage/import/rss-feed.md +++ b/docs/usage/import/rss-feed.md @@ -23,10 +23,10 @@ Here's a step-by-step guide to configure RSS ingesters: Additional configuration options: -- User responsible for data creation: Define the user responsible for creating data received from this RSS feed. Best practice is to dedicate one user per source for organizational clarity. Please [see the section "Best practices" below](import-automated.md#best-practices-section) for more information. +- User responsible for data creation: Define the user responsible for creating data received from this RSS feed. Best practice is to dedicate one user per source for organizational clarity. Please [go to the page ](../getting-started.md) for more information. - Import from date: Specify the date of the oldest data to retrieve. Leave the field empty to import everything. - Default report types: Indicate the report type to be applied to the imported report. -- Default author: Indicate the default author to be applied to the imported report. Please [see the section "Best practices" below](../import-automated.md#best-practices-section) for more information. +- Default author: Indicate the default author to be applied to the imported report. Please [go to the page](../getting-started.md) for more information. - Default marking definitions: Indicate the default markings to be applied to the imported reports. ![RSS feed configuration](../assets/rss-feed-configuration.png) From 3be9ab9ae95a2dea9217cfe4b8918acc36b7cc70 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:47:32 +0200 Subject: [PATCH 10/11] Fix file path to avoid broken link --- docs/usage/import/taxii-feed.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/usage/import/taxii-feed.md b/docs/usage/import/taxii-feed.md index f809b790..b6dfffc3 100644 --- a/docs/usage/import/taxii-feed.md +++ b/docs/usage/import/taxii-feed.md @@ -28,7 +28,7 @@ Here's a step-by-step guide to configure TAXII ingesters: Additional configuration options: -- User responsible for data creation: Define the user responsible for creating data received from this TAXII feed. Best practice is to dedicate one user per source for organizational clarity. Please [see the section "Best practices" below](../import-automated.md#best-practices-section) for more information. +- User responsible for data creation: Define the user responsible for creating data received from this TAXII feed. Best practice is to dedicate one user per source for organizational clarity. Please [go to the page](../getting-started.md) for more information. - Import from date: Specify the date of the oldest data to retrieve. Leave the field empty to import everything. -![TAXII feed configuration](../assets/taxii-feed-configuration.png) \ No newline at end of file +![TAXII feed configuration](../assets/taxii-feed-configuration.png) From 627263e434b1c4df3aa519a84a4d9fb0a0b6eca4 Mon Sep 17 00:00:00 2001 From: nino-filigran <148041607+nino-filigran@users.noreply.github.com> Date: Wed, 3 Sep 2025 11:48:17 +0200 Subject: [PATCH 11/11] Fix file path for more info --- docs/usage/import/taxii-push.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/usage/import/taxii-push.md b/docs/usage/import/taxii-push.md index 08d30cfc..5a135cc0 100644 --- a/docs/usage/import/taxii-push.md +++ b/docs/usage/import/taxii-push.md @@ -21,7 +21,7 @@ Here's a step-by-step guide to configure TAXII Push ingesters: 1. Name: Enter a name for the TAXII Push ingester. 2. Description (optional): Enter a description for the TAXII Push ingester. -3. User responsible for data creation: Define the user responsible for creating data received from this TAXII Push ingester. Best practice is to dedicate one user per source for organizational clarity. Please [see the section "Best practices" below](import-automated.md#best-practices-section) for more information. +3. User responsible for data creation: Define the user responsible for creating data received from this TAXII Push ingester. Best practice is to dedicate one user per source for organizational clarity. Please [go to the page](getting-started.md) for more information. 4. Accessible for: Enter the user, group or organization authorized to push data in the TAXII collection. 5. Copy confidence level to OpenCTI scores for indicators: Enable this option to map the confidence level associate to STIX indicators to the OpenCTI scoring system.