Building a SOC-Focused Threat Intelligence Lab with OpenCTI

I recently completed my M.S. in Cyber Security at California State University, Dominguez Hills, and I wanted to share one of my main capstone projects: a SOC-focused threat intelligence lab built with OpenCTI.

As part of my M.S. Cyber Security capstone project at California State University, Dominguez Hills, I built a SOC-focused threat intelligence lab using OpenCTI. The goal of the project was to demonstrate how a security team can centralize indicators of compromise, map adversary behavior to MITRE ATT&CK, and use structured threat intelligence to support detection, triage, enrichment, and incident response workflows.

Why I Built This Project

In a real SOC environment, analysts often deal with fragmented information. Indicators of compromise may come from different reports, tools, alerts, or external feeds. Without a structured platform, it becomes difficult to understand how an IP address, domain, malware family, threat actor, and attack technique connect to each other.

I wanted to build a project that showed how threat intelligence can move beyond static reports and become part of an operational SOC workflow. My objective was not only to deploy a tool, but to demonstrate how analysts could use threat intelligence to make faster and better decisions during investigations.

Technology Stack

For this project, I deployed and configured OpenCTI in a lab environment using Docker. The platform was used to organize and correlate threat intelligence entities such as:

• Indicators of compromise
• Malware
• Threat actors
• Attack patterns
• MITRE ATT&CK techniques
• Observables
• Reports and relationships between entities

The project also involved configuring the environment to support future connector-based enrichment, cloud deployment improvements, and DevSecOps automation.

What I Built

The main deliverable was a working OpenCTI threat intelligence platform designed around SOC use cases. I focused on showing how an analyst could move from a single indicator to a broader understanding of threat context.

For example, instead of treating an IOC as an isolated data point, the platform could help connect it to related malware, known adversary tactics, associated attack patterns, and MITRE ATT&CK mappings. This kind of enrichment is valuable because it helps analysts understand not only what was observed, but why it matters.

The project demonstrated several important workflows:

• Centralizing threat intelligence data
• Mapping indicators and attack patterns to MITRE ATT&CK
• Supporting SOC triage and enrichment
• Improving investigation context
• Organizing threat intelligence into a structured knowledge base
• Showing how threat intelligence can support incident response decisions

Security Value

The biggest security value of the project was showing how structured threat intelligence can improve analyst efficiency. In a SOC, speed and context matter. An alert may contain a suspicious domain or IP address, but the analyst still needs to understand whether it is related to known malicious activity, what techniques may be involved, and what follow-up actions should be taken.

OpenCTI helps support that process by giving analysts a central place to correlate technical indicators with higher-level threat intelligence. This can reduce manual research time, improve consistency during investigations, and help teams align their detection and response work with known adversary behavior.

What I Learned

This project helped me understand the importance of designing security tools around workflows, not just technology. Deploying the platform was only one part of the project. The more important part was thinking through how a SOC analyst would actually use the data during an investigation.

I also learned more about the relationship between threat intelligence and detection engineering. Good intelligence should not sit separately from security operations. It should help inform detection logic, alert enrichment, triage decisions, and incident response priorities.

Another key lesson was the importance of maintainability. A threat intelligence platform becomes more valuable when it can be extended through connectors, automation, and repeatable processes. That is why I continued thinking about cloud deployment, connector improvements, and DevSecOps automation as future enhancements.

I especially enjoyed the troubleshooting process behind this project. It reminded me that building security tools is not only about deploying software, but also about understanding dependencies, fixing issues, and making the environment usable for real investigation workflows.

Outcome

I successfully presented and defended this project as part of my M.S. Cyber Security capstone. The project gave me practical experience with threat intelligence operations, OpenCTI, Docker-based deployment, MITRE ATT&CK mapping, IOC enrichment, and SOC-focused investigation workflows.

This project also connects closely to my professional experience in SOC operations, where I worked with IBM QRadar, Microsoft Defender, Qualys, incident triage, vulnerability management, and security reporting. Together, these experiences helped me build a stronger understanding of how threat intelligence, monitoring, detection, and response fit together in real cybersecurity environments.

I plan to publish a separate step-by-step technical walkthrough in a future post.

Project Link

GitHub: https://github.com/scarecrowG59/secure-opencti-cloud-deployment