Skip to content

XTM One in OpenCTI

In OpenCTI, XTM One is the AI layer on top of the threat intelligence workflow you already use. You do not open XTM One to benefit from it: the capabilities appear inside OpenCTI, on the objects you are working on.

This page lists the concrete places where the two products meet, so you know where and when you can use XTM One.

Access points inside OpenCTI

Each access point is powered by a named capability — an intent — and each intent is answered by an agent that your administrators chose. Out of the box, the agents below handle them.

Where you find it What you can do Capability Default agent
The in-product AI assistant Hold a conversation with the current OpenCTI context already loaded global.assistant CTEM Assistant, which hands the conversation over to the OpenCTI Assistant
Text and description fields Summarize, explain, shorten, expand, fix spelling and grammar, change the tone of the content you are writing global.summarize, global.explain, global.make_it_shorter, global.make_it_longer, global.fix_spelling, global.change_tone OpenCTI Assistant
Search and filters Describe what you are looking for in plain language and get an OpenCTI filter in return cti.nlq_search OpenCTI NLQ
Containers — reports, groupings, cases Get a structured summary of the container, including the content of its attached files cti.container_summary OpenCTI Entity Insights
Entity pages — threat actors, intrusion sets, malware, organizations, sectors, and others Get a digest of the containers that mention the entity, an activity trend analysis, a forecast of future activity, or a summary of the entity's own modification history cti.containers_digest, cti.entity_activity, cti.entity_forecast, cti.entity_history OpenCTI Entity Insights
Automation playbooks Extract intelligence from documents into a STIX bundle, transform a bundle, or act on a bundle as the last step of a playbook cti.stix_harvester, cti.stix_transformer, cti.stix_consumer CTI STIX Harvester (Filigran AI) — or CTI STIX Harvester — then CTI STIX Transformer and CTI STIX Consumer

The exact wording of buttons and menu entries depends on your OpenCTI version, and an administrator can bind a different agent to any of these capabilities. What each access point does is stable; who answers it is a configuration choice.

Not the same as the MCP server

The access points above are AI actions inside OpenCTI. Connecting OpenCTI to XTM One also exposes OpenCTI's own tools to external MCP clients, which is a separate capability — see OpenCTI MCP server below.

Using XTM One from a playbook

Playbooks are the access point that matters most for automation, because the agent runs without anyone watching. Three distinct roles are available, and they differ by what the step receives and what it must return:

  • A harvester receives a document — a PDF, an office file, a text report — and returns a STIX 2.1 bundle. Use it to turn incoming reports into structured knowledge.
  • A transformer receives a STIX 2.1 bundle and returns a STIX 2.1 bundle. Use it to enrich, filter, rewrite, or normalize what is flowing through the playbook.
  • A consumer receives a STIX 2.1 bundle and takes a final action instead of returning a bundle — summarize it, alert on it, post it somewhere. It is a terminal step.

Because the playbook step expects a specific shape of answer, an agent bound to one of these capabilities has to respect it. If your administrators bind a custom agent to cti.stix_harvester or cti.stix_transformer, that agent must return a valid STIX 2.1 bundle; a consumer is free to return a readable report.

Results and failures of playbook-triggered runs are visible in XTM One under Work history, which is where to look when a playbook step did not produce what you expected.

Using OpenCTI from XTM One

The integration works in both directions. Once OpenCTI is registered, you can also start from XTM One:

  • Chat with an OpenCTI-aware agent. The OpenCTI Assistant and the other threat intelligence agents query your OpenCTI instance while they answer.
  • Build your own agents on OpenCTI data. The OpenCTI integration gives agents read and write tools for entities, observables, relationships, indicators, and containers. See Integrations.
  • Let agents work on a schedule. An agent can run on its own — for example to produce a recurring exposure briefing — and its runs appear in Work history.
  • Connect an external MCP client to work with OpenCTI knowledge from your own tooling.

What to expect when you use it

When you trigger an XTM One action from OpenCTI:

  • the current OpenCTI context is the starting point, so you do not have to re-explain it
  • XTM One routes the request to the agent bound to that capability, for the business context declared by your OpenCTI instance — CTI, FIMI, or Fraud-oriented workflows can resolve to different agents
  • the result is returned inside the OpenCTI experience rather than as a separate generic chat

This makes the feature feel more like an OpenCTI capability than a detached AI assistant.

Why a feature may be unavailable

You may not see a given XTM One action in OpenCTI if:

  • no agent is bound to that capability, or the bound agent is disabled
  • the bound agent is private, since an agent offered to platform users has to be company-managed or shared with a group
  • the binding targets a business context different from the one your OpenCTI instance declares
  • the action is not enabled for your deployment, or your OpenCTI version does not request that capability
  • your OpenCTI permissions do not allow the underlying operation

The product intentionally disables a feature when no suitable XTM One agent is available, rather than failing when you click. Administrators can check and fix all of this on the Intents page.

Permissions and trust

As an end user, you should expect XTM One to act within the boundaries of your OpenCTI access.

That means:

  • the analysis is based on what your current session can access
  • results should be reviewed as contextual assistance, not as an automatic truth
  • if a workflow requires validation, your product can still ask for human review

Good practices

  • Launch the action from the most relevant report, case, or document.
  • Use the output to speed up investigation, not to skip validation.
  • Prefer a playbook step over a manual action when the same treatment has to apply to every incoming document.
  • If an action is missing, ask whether the relevant XTM One capability has been configured for your environment.

OpenCTI MCP server

Connecting OpenCTI to XTM One also activates a native MCP server for the platform.

Any MCP-compatible client (Cursor, Claude Desktop, custom agents) can connect to https://<your-xtm-one>/mcp/opencti with a personal XTM One API key and search, read, create, and update threat intelligence knowledge — entities, observables, relationships, indicators, and containers — with your own OpenCTI permissions.

Find your endpoint and a ready-to-copy client configuration in My Profile > MCP Endpoint, and see Platform MCP servers for the full guide.

Next step

Continue with XTM One in OpenAEV if your organization also uses adversarial exposure validation workflows. Administrators who need to change which agent answers a capability should read Intents.