How to integrate OpenBAS into OpenCTI

[ghost]

Hi all,
I successfully installed OpenCTI and OpenBAS on the same machine with Docker for Desktop. Where can I integrate OpenBAS in OpenCTI ? When I press simulate a window pop's up, telling me from where I can install OpenBAS, which already is. Searching through settings gives no results as well as searching the doc's and github.

Any help would be greatly appreciated.

Keep up the excellent work on these superb products.

best,
Andreas

[savacano28]

Hi @divemaster1201,

To integrate OpenCTI with OpenBAS, you need to set two parameters in your environment file: XTM__OPENBAS_URL and XTM__OPENBAS_TOKEN (You can obtain the token from your profile in the API access section). These environment variables are equivalent to xtm:openbas_url and xtm:openbas_token in the default.json file. For more details, refer to the documentation here:

• OpenCTI Configuration
• OpenCTI Docker Installation

Additionally, you can find more information about creating scenarios from OpenCTI here:

• OpenBas OpenCTI Scenario Usage

Feel free to reach out to the Slack community if you have any more questions or need help!

[0xLhu]

Hello there :) , i need some help please !

I have already set the variable XTM in opencti and openbas , bu i got error when querying openbas with opencti during scenario scenarios emulation .

Here is my docker-compose about OpenCTI and OpenBAS :

 openbas:
    image: openbas/platform:${OPENBAS_VERSION}
    container_name: openbas
    hostname: openbas
    environment:
      #- SERVER_SSL_ENABLED=yes
      - SERVER_SSL_KEY-STORE-PASSWORD=${KEYSTORE_PASSWORD}
        #- SERVER_SSL_KEY-STORE-TYPE=JKS
        #- SERVER_SSL_KEY-STORE=/keystore.jks
        #- SERVER_SSL_KEY-ALIAS=Openbas
      - OPENBAS_BASE-URL=${OPENBAS_BASE_URL}
      - OPENBAS_AUTH-LOCAL-ENABLE=true
      - SPRING_DATASOURCE_URL=jdbc:postgresql://pgsql:5432/openbas
      - SPRING_DATASOURCE_USERNAME=${POSTGRES_USER}
      - SPRING_DATASOURCE_PASSWORD=${POSTGRES_PASSWORD}
      - MINIO_ENDPOINT=minio
      - MINIO_ACCESS-KEY=${MINIO_ROOT_USER}
      - MINIO_ACCESS-SECRET=${MINIO_ROOT_PASSWORD}
      - OPENBAS_RABBITMQ_HOSTNAME=rabbitmq
      - OPENBAS_RABBITMQ_USER=${RABBITMQ_DEFAULT_USER}
      - OPENBAS_RABBITMQ_PASS=${RABBITMQ_DEFAULT_PASS}
      - SPRING_MAIL_HOST=${SPRING_MAIL_HOST}
      - SPRING_MAIL_PORT=${SPRING_MAIL_PORT}
      - SPRING_MAIL_USERNAME=${SPRING_MAIL_USERNAME}
      - SPRING_MAIL_PASSWORD=${SPRING_MAIL_PASSWORD}
      - SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH=${SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH}
      - SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=${SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE}
      - SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_TRUST=*
      - SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=${SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE}
      - OPENBAS_MAIL_IMAP_ENABLED=false
      - OPENBAS_MAIL_IMAP_HOST=${OPENBAS_MAIL_IMAP_HOST}
      - OPENBAS_MAIL_IMAP_PORT=${OPENBAS_MAIL_IMAP_PORT}
      - OPENBAS_MAIL_IMAP_USERNAME=${SPRING_MAIL_USERNAME}
      - OPENBAS_MAIL_IMAP_PASSWORD=${SPRING_MAIL_PASSWORD}
      - OPENBAS_MAIL_IMAP_AUTH=${OPENBAS_MAIL_IMAP_AUTH}
      - OPENBAS_MAIL_IMAP_SSL_ENABLE=${OPENBAS_MAIL_IMAP_SSL_ENABLE}
      - OPENBAS_MAIL_IMAP_SSL_TRUST=*
      - OPENBAS_MAIL_IMAP_STARTTLS_ENABLE=${OPENBAS_MAIL_IMAP_STARTTLS_ENABLE}
      - OPENBAS_ADMIN_EMAIL=${OPENBAS_ADMIN_EMAIL}
      - OPENBAS_ADMIN_PASSWORD=${OPENBAS_ADMIN_PASSWORD}
      - OPENBAS_ADMIN_TOKEN=${OPENBAS_ADMIN_TOKEN}
      - INJECTOR_CALDERA_ENABLE=true
      - INJECTOR_CALDERA_URL=http://locahost:8888
      - INJECTOR_CALDERA_PUBLIC_URL=${CALDERA_PUBLIC_URL}
      - INJECTOR_CALDERA_API_KEY=${CALDERA_API_KEY}
      - EXECUTOR_CALDERA_ENABLE=true
      - EXECUTOR_CALDERA_URL=http://caldera:8888
      - EXECUTOR_CALDERA_PUBLIC_URL=${CALDERA_PUBLIC_URL}
      - EXECUTOR_CALDERA_API_KEY=${CALDERA_API_KEY}
      - LOGGING_LEVEL_IO_OPENBAS=debug
      - OPENBAS_XTM_OPENCTI_URL=${OPENBAS_XTM_OPENCTI_URL}
      - OPENBAS_XTM_OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}
      - OPENBAS_XTM_OPENCTI_ENABLE=true
    volumes:
      - ./keystore.jks:/keystore.jks
    ports:
      - "8081:8080"
    depends_on:
      - pgsql
      - minio
      - rabbitmq
    restart: always
    
    
      caldera:
    image: openbas/caldera-server:5.1.0
    container_name: caldera
    hostname: caldera
    restart: always
    ports:
      - "8888:8888"  # Expose le port Caldera pour accès depuis localhost
    environment:
      - CALDERA_URL=http://localhost:8888  # URL spécifique pour Caldera
     # - VITE_CALDERA_URL=http://localhost:8888
    command: --log DEBUG  # Niveau de log détaillé
    volumes:
      - type: bind
        source: ./caldera.yml  # Montre votre fichier caldera.yml
        target: /usr/src/app/conf/local.yml

  opencti:
    image: opencti/platform:${OPENCTI_VERSION}
    container_name: opencti
    hostname: opencti
    environment:
      - NODE_OPTIONS=--max-old-space-size=8096
      - APP__PORT=8080
      - APP__BASE_URL=${OPENCTI_BASE_URL}
      - APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL}
      - APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}
      - APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}
      - APP__APP_LOGS__LOGS_LEVEL=error
      - REDIS__HOSTNAME=redis
      - REDIS__PORT=6379
      - ELASTICSEARCH__URL=http://elasticsearch:9200
      - MINIO__ENDPOINT=minio
      - MINIO__PORT=9000
      - MINIO__USE_SSL=false
      - MINIO__ACCESS_KEY=${MINIO_ROOT_USER}
      - MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}
      - RABBITMQ__HOSTNAME=rabbitmq
      - RABBITMQ__PORT=5672
      - RABBITMQ__PORT_MANAGEMENT=15672
      - RABBITMQ__MANAGEMENT_SSL=false
      - RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}
      - RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}
      - SMTP__HOSTNAME=${SMTP_HOSTNAME}
      - SMTP__PORT=25
      - PROVIDERS__LOCAL__STRATEGY=LocalStrategy
      - APP__HEALTH_ACCESS_KEY=${OPENCTI_HEALTHCHECK_ACCESS_KEY}
      - XTM__OPENBAS_URL=http://openbas:8081
      - XTM__OPENBAS_TOKEN=${OPENBAS_ADMIN_TOKEN}
    ports:
      - "8080:8080"
    depends_on:
      redis:
        condition: service_healthy
      elasticsearch:
        condition: service_healthy
      minio:
        condition: service_healthy
      rabbitmq:
        condition: service_healthy
    restart: always
    healthcheck:
      test:
        [
          "CMD",
          "wget",
          "-qO-",
          "http://opencti:8080/health?health_access_key=${OPENCTI_HEALTHCHECK_ACCESS_KEY}",
        ]
      interval: 10s
      timeout: 5s
      retries: 20

Plus i put caldera directly in the same compose, but i got errors in OpenBAS "Executor Caldera might not be working"

My .env (no worries it's only for test) :

[email protected]
OPENCTI_ADMIN_PASSWORD=changeme
OPENCTI_ADMIN_TOKEN=#valid UUID V4
OPENCTI_BASE_URL=http://opencti:8080   #or localhost
OPENCTI_HEALTHCHECK_ACCESS_KEY=changeme
MINIO_ROOT_USER=Minio
MINIO_ROOT_PASSWORD=changeme
RABBITMQ_DEFAULT_USER=rabbitmq
RABBITMQ_DEFAULT_PASS=changeme
CONNECTOR_EXPORT_FILE_STIX_ID=dd817c8b-abae-460a-9ebc-97b1551e70e6
CONNECTOR_EXPORT_FILE_CSV_ID=7ba187fb-fde8-4063-92b5-c3da34060dd7
CONNECTOR_EXPORT_FILE_TXT_ID=ca715d9c-bd64-4351-91db-33a8d728a58b
CONNECTOR_IMPORT_FILE_STIX_ID=72327164-0b35-482b-b5d6-a5a3f76b845f
CONNECTOR_IMPORT_DOCUMENT_ID=c3970f8a-ce4b-4497-a381-20b7256f56f0
CONNECTOR_ANALYSIS_ID=4dffd77c-ec11-4abe-bca7-fd997f79fa36
SMTP_HOSTNAME=localhost
ELASTIC_MEMORY_SIZE=4G
OPENBAS_BASE_URL=http://openbas:8081 # 8081 is for example you can use whatever you want
POSTGRES_USER=postgres
POSTGRES_PASSWORD=changeme
KEYSTORE_PASSWORD=changeme
SPRING_MAIL_HOST=smtp.changeme.com
SPRING_MAIL_PORT=465
[email protected]
SPRING_MAIL_PASSWORD=changeme
SPRING_MAIL_PROPERTIES_MAIL_SMTP_AUTH=true
SPRING_MAIL_PROPERTIES_MAIL_SMTP_SSL_ENABLE=true
SPRING_MAIL_PROPERTIES_MAIL_SMTP_STARTTLS_ENABLE=false
OPENBAS_MAIL_IMAP_HOST=imap.changeme.com
OPENBAS_MAIL_IMAP_PORT=993
OPENBAS_MAIL_IMAP_AUTH=true
OPENBAS_MAIL_IMAP_SSL_ENABLE=true
OPENBAS_MAIL_IMAP_STARTTLS_ENABLE=false
[email protected]
OPENBAS_ADMIN_PASSWORD=changeme
OPENBAS_ADMIN_TOKEN=  #Like the Opencti token Admin
CALDERA_PUBLIC_URL=http://caldera:8888 # Change me for production deployment to something accessible from your endpoint(s)
CALDERA_API_KEY=changeme
COLLECTOR_MITRE_ATTACK_ID=# UUIDV4
COLLECTOR_ATOMIC_RED_TEAM_ID= # UUIDV4
OPENCTI_VERSION=6.5.5  # Don't forget to follow every new update same for openbas
OPENBAS_VERSION=1.13.1
OPENBAS_XTM_OPENCTI_URL=http://opencti:8080  #Here put the url for your opencti instance for established the link between the 2 platform 

Thank you :)

[ebelious]

I tested your health check and get an auth error. Error connection refused. Sorry on my phone and can't send logs,

Docker logs opencti-openbas-1

[ebelious]

I also get the same error when attempting to 'Simulate' via opencti

[ebelious]

I am getting this in opencti logs:

{"level":"info","message":"[MIGRATION] Read 0 migrations from the database","timestamp":"2025-05-14T19:55:09.598Z"}
{"level":"info","message":"[MIGRATION] Platform already up to date, nothing to migrate","timestamp":"2025-05-14T19:55:09.609Z"}
{"level":"info","message":"[MIGRATION] Migration process completed","timestamp":"2025-05-14T19:55:09.610Z"}
{"category":"APP","cause":{"attributes":{"cause":{"code":"UNKNOWN_ERROR","message":"connect ECONNREFUSED 192.168.128.25:8081","name":"Error","stack":"Error: connect ECONNREFUSED 192.168.128.25:8081\n at Function.AxiosError.from (/opt/opencti/build/back.js:1884:228301)\n at RedirectableRequest. (/opt/opencti/build/back.js:1887:16942)\n at RedirectableRequest.emit (node:events:518:28)\n at ClientRequest.eventHandlers. (/opt/opencti/build/back.js:669:10029)\n at ClientRequest.emit (node:events:518:28)\n at emitErrorEvent (node:_http_client:104:11)\n at Socket.socketErrorListener (node:_http_client:518:5)\n at Socket.emit (node:events:518:28)\n at emitErrorNT (node:internal/streams/destroy:170:8)\n at emitErrorCloseNT (node:internal/streams/destroy:129:3)\n at processTicksAndRejections (node:internal/process/task_queues:90:21)\n at Axios.request (/opt/opencti/build/back.js:1889:3318)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at createScenario (/opt/opencti/build/back.js:3570:16663)\n at generateOpenBasScenarioWithInjectPlaceholders (/opt/opencti/build/back.js:3674:1432)"},"genre":"TECHNICAL","http_status":500},"code":"DATABASE_ERROR","message":"Error querying OpenBAS","name":"DATABASE_ERROR","stack":"GraphQLError: Error querying OpenBAS\n at error (/opt/opencti/build/back.js:1824:2273)\n at DatabaseError (/opt/opencti/build/back.js:1824:3381)\n at createScenario (/opt/opencti/build/back.js:3570:17885)\n at processTicksAndRejections (node:internal/process/task_queues:105:5)\n at generateOpenBasScenarioWithInjectPlaceholders (/opt/opencti/build/back.js:3674:1432)"},"level":"error","message":"Error querying OpenBAS","operation":"StixCoreObjectSimulationResultObasThreatGenerateScenarioWithInjectPlaceholdersMutation","size":233,"source":"backend","time":307,"timestamp":"2025-05-14T19:59:38.094Z","type":"WRITE_ERROR","user_id":"a1af04b8-8d56-47a6-a412-ec41d90f84f8","version":"6.6.10"}

openbas:
####### ######## ######## ## ## ######## ### ######

## ## ## ## ### ## ## ## ## ## ##

## ## ## ## #### ## ## ## ## ##

## ######## ###### ## ## ## ######## ## ##

## ## ## ## #### ## ## #########

## ## ## ## ### ## ## ## ## ##

####### ## ######## ## ## ######## ## ## ######
1.16.1

[ebelious]

I changes all of the url's to the host IP besides 'OPENBAS_XTM_OPENCTI_URL' whichi left as http://opencti. This is working now

[SnoozyNinja]

Hi - I'm trying to get this up and running in my lab, where did you change all of the URLs to the host ip, was it just in the .env or the docker-compose, or both? Any help is appreciated!