CTI Butler

Before you begin...

We offer a fully hosted web version of CTI Butler which includes many additional features over those in this codebase. You can find out more about the web version here.

Overview

A web API for the following STIX 2.1 datasets:

• MITRE ATT&CK Enterprise
• MITRE ATT&CK ICS
• MITRE ATT&CK Mobile
• MITRE CAPEC
• MITRE CWE
• MITRE ATLAS
• Locations
• TLP
• DISARM

tl;dr

Watch the demo.

Install

Download and configure

# clone the latest code
git clone https://github.com/muchdogesec/ctibutler

Configuration options

CTI Butler has various settings that are defined in an .env file.

To create a template for the file:

cp .env.example .env

To see more information about how to set the variables, and what they do, read the .env.markdown file.

Build the Docker Image

sudo docker compose build

Start the server

sudo docker compose up

Access the server

The webserver (Django) should now be running on: http://127.0.0.1:8006/

You can access the Swagger UI for the API in a browser at: http://127.0.0.1:8006/api/schema/swagger-ui/

Quickstart

Once you've got CTI Butler running, you can use the following script to import all current and historical data. See utilities/README.md

Support

Minimal support provided via the DOGESEC community.

License

Apache 2.0.