CTI-Transmute: Harmonizing Threat Intelligence in a Multi-Standard Ecosystem
summary
CTI-Transmute is an open-source conversion layer that reliably maps between the MISP Standard and STIX by building on the misp-stix/MiSTIC library, exposing a live conversion API and a web UI that operate in production. It encodes semantic translation rules (about 35k lines of Python), supports bidirectional, best-effort loss-minimizing mappings, already integrates with RuleSet and AIL, can reuse 400 MISP modules for enrichment, and is running operationally with a public service and a self-hosted option.
AI-written summary · about
chapters (15)
- 0:00Introduction
- 1:10Multi-format CTI interoperability
- 3:36Why CTI Transmute developed
- 5:45Core concept of CTI Transmute
- 8:52CTI format conversion challenges
- 9:34CTI Transmute today
- 11:56API and web interface
- 13:21Conversion engine support
- 16:55STIX 1 vs STIX 2 adoption
- 18:19Advanced CTI conversion
- 21:07Live conversion use cases
- 23:12Conversion configuration
- 24:16Current integrations
- 26:20Future roadmap
- 28:46Call to action
related talks
27mIndicator Message eXchange (IMX): Enabling Structured Cyber Threat Intelligence Sharing
29mA Collective CTI Doctrine
30mHow to Create Effective Structured Intelligence Extensions for TIPs
22mSolving CTI Sector Incoherence in a Living Growing OpenCTI Repository: Extend STIX 2.1 FTW
01h 01mIntroduction To STIX/TAXII 2 Standards
30mMISP 3 - Teaching an Old Dog New Tricks
03h 43mMISP Fundamentals
38mCruising Ocean Threat With TheHive, Cortex & MISP Without Sinking