From Labels to Graph: Malanta Attribution Now Runs Inside OpenCTI

Most OpenCTI teams assume that once a TAXII feed lands, attribution is done.

It is not. Indicators arrive. Labels arrive. Yet the graph often stays flat. You can filter on a string. You cannot navigate from an actor to every related indicator the way analysts actually work.

That gap is exactly what the new Malanta Attribution connector closes. It is now listed in the Filigran OpenCTI Integrations Library, with full technical documentation in the OpenCTI connectors repository.

The problem OpenCTI TAXII ingestion does not solve alone

Malanta publishes pre-attack infrastructure intelligence over STIX 2.1 and TAXII 2.1. OpenCTI's built-in TAXII ingester imports that feed correctly. No custom import connector is required for bulk ingestion, pagination, watermarking, or backpressure. That part already works.

What it does not do is transform attribution.

Threat-actor attribution on Malanta indicators arrives as namespaced labels, for example apt:APT44 or apt:APT38. A label is searchable. It is not a first-class entity. Analysts cannot pivot from Intrusion Set to infrastructure the way they expect inside a TIP. Nothing automatically links apt:APT38 on one indicator to the same actor on another.

In a Threat Intelligence Platform, that difference matters. Labels are metadata. Relationships are knowledge.

What the Malanta Attribution connector does

The connector is a stream connector, not a second feed. It listens to OpenCTI's live event stream. For every Malanta indicator carrying an apt: label, it:

1. Creates the matching Intrusion Set when needed
2. Creates an indicates relationship from the Indicator to that Intrusion Set

The result is a pivotable attribution graph instead of a pile of opaque label strings.

It is designed to run alongside OpenCTI's native TAXII ingestion. The platform handles the bulk import. The connector only reacts to the smaller share of indicators that carry attribution. That keeps the path light even when the feed is large.

Provenance is checked on every event. Indicators authored by another source are skipped, so a second feed using a similar apt: convention is not credited to Malanta. The source organization is configurable.

What it deliberately does not do

This is as important as what it creates.

Malanta's feed also emits infrastructure clusters as their own Intrusion Set objects, with relationships from indicators into those clusters. A cluster may aggregate infrastructure linked to more than one actor. Applying an apt: label to a cluster would invent false ownership.

So attribution is applied to indicators only. Cluster entities stay exactly as ingested.

The connector also does not auto-merge aliases. APT44 and Sandworm remain separate until an analyst merges them in OpenCTI. That keeps the TIP under human control where naming conventions differ across sources.

Derived objects use deterministic IDs, inherit confidence and markings from the source indicator, and never rewrite the indicator that triggered them. The connector cannot re-trigger itself.

Why this matters for Pre-Attack Prevention in the TIP

Malanta's job is earlier than classic IOC feeds. We surface Indicators of Pre-Attack (IoPAs) during Resource Development (MITRE ATT&CK TA0042): domains, hosts, certificates, and related staging infrastructure before the campaign goes live.

For OpenCTI customers, value is not only "more indicators." Value is operational graph quality:

• Native TAXII keeps the feed current without custom import plumbing
• Attribution becomes navigable knowledge, not a string filter
• Infrastructure clusters remain infrastructure clusters, not falsely renamed actors
• Analysts can move from Intrusion Set to pre-attack indicators in the same workflow they already use for hunting and enrichment

That is how Mean Time to Preempt (MTTP) gets shorter inside the TIP: earlier signals, linked to the right actor context, without forcing a rip-and-replace of the stack.

How OpenCTI customers should deploy it

Order matters. The connector reacts to live events. Indicators already present when it starts generate no events and therefore no attribution until you backfill.

Recommended order from the connector documentation:

1. Create a Live Stream filtered to Indicator entities (and to the Malanta organization if you ingest multiple feeds)
2. Start the Malanta Attribution connector
3. Configure OpenCTI's built-in TAXII ingester against Malanta

TAXII configuration values documented for OpenCTI:

• Name: Malanta Pre-Attack Indicators
• TAXII server URL: https://app.malanta.ai/feeds/taxii2/default
• TAXII version: TAXII 2.1
• Collection: pre-attack-indicators
• Authentication: Bearer token (Malanta API key)

Leave "Import from date" empty in production. Bounding the import by date can produce an incomplete graph because the feed's object streams are filtered independently. Re-ingestion is safe: IDs are deterministic, so a second pass upserts rather than duplicates.

If the feed was already ingested before the connector started, run the documented backfill.py once. Dry-run first, then apply. Re-running it is a no-op when objects already match.

The connector never contacts Malanta and never needs the API key. That credential stays in the TAXII ingester configuration, where OpenCTI encrypts it at rest.

Full install, environment variables, debugging table, and behavior notes live in the GitHub README. OpenCTI's general connector guidance is in the external connectors documentation. Malanta STIX/TAXII API details are in the Malanta APIs help article.

Key values for Malanta STIX/TAXII customers on OpenCTI

• Standards-native path. STIX 2.1 over TAXII 2.1 into OpenCTI's built-in ingester. No custom bulk-import connector required for the feed itself.
• TIP-ready attribution. Flat apt: labels become Intrusion Sets plus indicates relationships, so pivots work the way analysts expect.
• Complementary architecture. TAXII owns volume. The stream connector owns the attribution transform. Each stays small and correct.
• Source integrity. Only indicators authored by Malanta (configurable) are attributed, so other feeds cannot pollute Malanta provenance.
• Cluster honesty. Infrastructure clusters are not rewritten into single-actor entities. Multi-actor staging stays multi-actor.
• Safe replay. Deterministic IDs, marking and confidence inheritance, feedback-loop safety, and an optional backfill path for existing data.
• Discoverable support path. Listed on the Filigran Hub with contributor contact at [email protected].

The Bottom Line

OpenCTI customers should not have to choose between a clean TAXII import and a usable attribution graph. Malanta's feed already lands as STIX. The new Attribution connector turns actor labels into relationships that analysts can actually pivot.

That is Pre-Attack Prevention inside the TIP: earlier infrastructure signals, linked to the right Intrusion Sets, without rewriting how OpenCTI already ingests TAXII.

Explore the connector on the Filigran OpenCTI Integrations Library, follow the technical documentation on GitHub, and talk to Malanta if you want the pre-attack feed wired into your OpenCTI deployment.