XTM One in OpenAEV
In OpenAEV, XTM One supports adversarial exposure validation work without requiring you to leave the OpenAEV experience. As in OpenCTI, the capabilities appear inside the product, attached to the scenario, inject, or exercise you are working on.
Access points inside OpenAEV
Each access point is powered by a named capability — an intent — answered by an agent your administrators chose. These are the agents that handle them out of the box.
| Where it applies | What you can do | Capability | Default agent |
|---|---|---|---|
| The in-product AI assistant | Hold a conversation about the current OpenAEV context — scenarios, simulations, results | global.assistant |
CTEM Assistant, which hands the conversation over to the OpenAEV Assistant |
| Text and description fields | Summarize, explain, shorten, expand, fix spelling and grammar, change the tone of the content you are writing | global.summarize, global.explain, global.make_it_shorter, global.make_it_longer, global.fix_spelling, global.change_tone |
OpenAEV Assistant |
| Exercise content | Generate the messages used in an adversary emulation exercise | aev.message_generator |
OpenAEV Assistant |
| Exercise content | Generate a media article for an adversary emulation exercise | aev.media_article_generator |
OpenAEV Assistant |
| Phishing content | Generate a phishing lure email (subject, HTML body, and plain-text fallback) for an authorized phishing simulation | aev.phishing_email_html_generator |
AEV Phishing Email Generator |
| Phishing content | Generate a phishing landing page (HTML and CSS) for an authorized credential-capture simulation | aev.phishing_landing_page_html_generator |
AEV Phishing Landing Page Generator |
| Detection and remediation | Turn a malware behavior description into detection rules, with the processes, commands, files, and ATT&CK techniques it relies on | aev.detection_rules_generator |
AEV Detection Rules Generator |
| Document analysis | Extract tactics, techniques, and procedures from a document | cti.ttp_harvester |
CTI TTP Harvester (Filigran AI) |
The exact wording of buttons and menu entries depends on your OpenAEV version, and an administrator can bind a different agent to any of these capabilities.
Beyond these contextual actions, the OpenAEV Assistant and the scenario and payload agents can also be used from XTM One itself — to design a scenario, propose injects, or review the outcome of an exercise, with the results written back into OpenAEV.
What to expect when you use it
When you trigger an XTM One action from OpenAEV:
- the current OpenAEV context is reused, so you do not have to restate it
- XTM One routes the request to the agent bound to that capability for the
aevbusiness context - the result comes back as part of the OpenAEV experience
Longer-running work can continue in the background; those runs appear in Work history in XTM One.
Why a feature may be unavailable
An action can be hidden or disabled if:
- the OpenAEV instance is not registered with XTM One
- no agent is bound to that capability, or the bound agent is disabled
- the bound agent is private rather than company-managed or shared with a group
- the binding targets another business context than
aev - your OpenAEV permissions do not allow the related operation
Administrators can review and fix the routing on the Intents page.
Permissions and review
As with other suite products, you should expect:
- the action to respect your current OpenAEV permissions
- results to be treated as operational assistance, not final truth by default
- some sensitive workflows to include a review or validation step
Good practices
- Start the action from the scenario or exercise that already contains the relevant context.
- Review generated proposals before applying them to an operational workflow.
- Ask your administrator if the expected action is missing or unavailable.
OpenAEV MCP server
Connecting OpenAEV to XTM One also activates a native MCP server for the platform.
Any MCP-compatible client (Cursor, Claude Desktop, custom agents) can connect to https://<your-xtm-one>/mcp/openaev with a personal XTM One API key and search, read, and manage scenarios, simulations, payloads, injects, atomic tests, and findings — with your own OpenAEV permissions.
Find your endpoint and a ready-to-copy client configuration in My Profile > MCP Endpoint, and see Platform MCP servers for the full guide.
Next step
Return to the main XTM One guide for the broader platform chapters, starting with Home Dashboard when needed. Administrators who need to change which agent answers a capability should read Intents.