CTI providers reference
Ticketra supports six threat-intelligence providers. The configuration flow is the same for each (see Connect a CTI provider); this page summarizes what each one offers and which observable types it serves.
Supported providers
| Provider | Best for | Typical observable types |
|---|---|---|
| VirusTotal | File/URL/domain/IP reputation aggregation | HASH_*, DOMAIN, IP |
| AbuseIPDB | IP abuse reputation & confidence scoring | IP |
| MISP | Self-hosted threat sharing (air-gap friendly) | IP, DOMAIN, HASH_* |
| Shodan | Host/service exposure & open ports | IP |
| GreyNoise | Internet background-noise classification (benign scanner vs targeted) | IP |
| OTX AlienVault | Open Threat Exchange pulses & community indicators | IP, DOMAIN, HASH_* |
What gets enriched
Across all providers, only these observable types are ever sent externally:
IP · DOMAIN · HASH_MD5 · HASH_SHA1 · HASH_SHA256
Private IPs are suppressed
Internal/private IP addresses are never transmitted to any external provider. Outbound payloads are minimized to the observable value.
Choosing providers
- Reduce false positives on IPs: combine GreyNoise (is this just internet noise?) with AbuseIPDB (is it actually abusive?).
- File hashes: VirusTotal and OTX give broad coverage.
- Exposure context: Shodan tells you what a host exposes.
- Air-gapped or sharing-community deployments: point MISP at your internal instance.
Keys & security
- API keys are encrypted at rest (AES-256-GCM, scrypt-derived key) and never returned in plaintext.
- Each provider is configured and toggled independently under Admin → Integrations.
Auto-tagging
Any provider's verdict can drive auto-tagging with a threshold of malicious_only or malicious_or_suspicious.
Related
Was this page helpful?