Skip to main content

Connect a CTI provider

Integrator

Ticketra enriches observables using external Cyber Threat Intelligence (CTI) providers. This guide uses VirusTotal as the example; the same flow applies to the other supported providers.

Supported providers​

ProviderGood for
VirusTotalFile hashes, domains, IPs
AbuseIPDBIP reputation
MISPSelf-hosted threat sharing (air-gap friendly)
ShodanHost/service exposure
GreyNoiseInternet background-noise classification
OTX AlienVaultOpen threat exchange pulses

What can be enriched​

Only these observable types are sent to providers:

IP · DOMAIN · HASH_MD5 · HASH_SHA1 · HASH_SHA256

Private IPs are suppressed

Ticketra never sends private/internal IP addresses to external providers. Outbound payloads are also minimized to the observable value itself.

Configure VirusTotal​

  1. Sign in as an ADMIN or SUPER_ADMIN.
  2. Go to Admin → Integrations.
  3. Select VirusTotal and choose Configure.
  4. Paste your VirusTotal API key and enable the provider.
  5. Save.
API keys are encrypted at rest

Provider API keys are encrypted with AES-256-GCM using a key derived (via scrypt) from your integration_encryption_key secret. Keys are never returned in plaintext through the API.

Verify it works​

  1. Open any enrichable observable (for example an external IP).
  2. Choose Enrich.
  3. You should see a verdict and supporting detail returned from VirusTotal.

Auto-tagging from verdicts​

You can have enrichment automatically tag observables based on provider verdicts. Choose a threshold:

ThresholdTags an observable when…
malicious_onlythe verdict is malicious
malicious_or_suspiciousthe verdict is malicious or suspicious

This turns raw enrichment results into actionable signal your analysts can filter on.

MISP for air-gapped deployments​

If you run offline, point the MISP provider at your internal MISP instance instead of internet-based providers. MISP's base URL is configurable per the integration settings.