docker-compose.yml

version: '3'

services:

  redis:

    image: redis:7.0.4

    restart: always

    volumes:

      - redisdata:/data

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

  elasticsearch:

    image: docker.elastic.co/elasticsearch/elasticsearch:8.4.1

    volumes:

      - esdata:/usr/share/elasticsearch/data

    environment:

      # Comment out the line below for single-node

      - discovery.type=single-node

      # Uncomment line below below for a cluster of multiple nodes

      # - cluster.name=docker-cluster

      - xpack.ml.enabled=false

      - xpack.security.enabled=false

      - "ES_JAVA_OPTS=-Xms${ELASTIC_MEMORY_SIZE} -Xmx${ELASTIC_MEMORY_SIZE}"

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    ulimits:

      memlock:

        soft: -1

        hard: -1

      nofile:

        soft: 65536

        hard: 65536

  minio:

    image: minio/minio:latest

    volumes:

      - s3data:/data

    ports:

      - "9008:9000"

    deploy:

      placement:

        constraints: [node.labels.dev == true ]    

    environment:

      MINIO_ROOT_USER: ${MINIO_ROOT_USER}

      MINIO_ROOT_PASSWORD: ${MINIO_ROOT_PASSWORD}    

    command: server /data

    healthcheck:

      test: ["CMD", "curl", "-f", "http://localhost:9000/minio/health/live"]

      interval: 30s

      timeout: 20s

      retries: 3

    restart: always

  rabbitmq:

    image: rabbitmq:3.10-management

    environment:

      - RABBITMQ_DEFAULT_USER=${RABBITMQ_DEFAULT_USER}

      - RABBITMQ_DEFAULT_PASS=${RABBITMQ_DEFAULT_PASS}

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    volumes:

      - amqpdata:/var/lib/rabbitmq

    restart: always

  opencti:

    image: opencti/platform:latest

    environment:

      - NODE_OPTIONS=--max-old-space-size=8096

      - APP__PORT=8080

      - APP__BASE_URL=${OPENCTI_BASE_URL}

      - APP__ADMIN__EMAIL=${OPENCTI_ADMIN_EMAIL}

      - APP__ADMIN__PASSWORD=${OPENCTI_ADMIN_PASSWORD}

      - APP__ADMIN__TOKEN=${OPENCTI_ADMIN_TOKEN}

      - APP__APP_LOGS__LOGS_LEVEL=error

      - REDIS__HOSTNAME=redis

      - REDIS__PORT=6379

      - ELASTICSEARCH__URL=http://elasticsearch:9200

      - MINIO__ENDPOINT=minio

      - MINIO__PORT=9000

      - MINIO__USE_SSL=false

      - MINIO__ACCESS_KEY=${MINIO_ROOT_USER}

      - MINIO__SECRET_KEY=${MINIO_ROOT_PASSWORD}

      - RABBITMQ__HOSTNAME=rabbitmq

      - RABBITMQ__PORT=5672

      - RABBITMQ__PORT_MANAGEMENT=15672

      - RABBITMQ__MANAGEMENT_SSL=false

      - RABBITMQ__USERNAME=${RABBITMQ_DEFAULT_USER}

      - RABBITMQ__PASSWORD=${RABBITMQ_DEFAULT_PASS}

      - SMTP__HOSTNAME=${SMTP_HOSTNAME}

      - SMTP__PORT=25

      - PROVIDERS__LOCAL__STRATEGY=LocalStrategy

    ports:

      - "8080:8080"

    depends_on:

      - redis

      - elasticsearch

      - minio

      - rabbitmq

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

      mode: replicated

  worker:

    image: opencti/worker:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - WORKER_LOG_LEVEL=info

    depends_on:

      - opencti

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

      mode: replicated

      replicas: 3

    restart: always

  # connector-history:

  #   image: opencti/connector-history:5.3.17

  #   environment:

  #     - OPENCTI_URL=http://opencti:8080

  #     - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

  #     - CONNECTOR_ID=${CONNECTOR_HISTORY_ID} # Valid UUIDv4

  #     - CONNECTOR_TYPE=STREAM

  #     - CONNECTOR_NAME=History

  #     - CONNECTOR_SCOPE=history

  #     - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

  #     - CONNECTOR_LOG_LEVEL=info

  #   restart: always

  #   deploy:

  #     placement:

  #       constraints: [node.labels.dev == true ]

  #  depends_on:

  #    - opencti

  connector-export-file-stix:

    image: opencti/connector-export-file-stix:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_STIX_ID} # Valid UUIDv4

      - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE

      - CONNECTOR_NAME=ExportFileStix2

      - CONNECTOR_SCOPE=application/json

      - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-export-file-csv:

    image: opencti/connector-export-file-csv:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_CSV_ID} # Valid UUIDv4

      - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE

      - CONNECTOR_NAME=ExportFileCsv

      - CONNECTOR_SCOPE=text/csv

      - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-export-file-txt:

    image: opencti/connector-export-file-txt:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=${CONNECTOR_EXPORT_FILE_TXT_ID} # Valid UUIDv4

      - CONNECTOR_TYPE=INTERNAL_EXPORT_FILE

      - CONNECTOR_NAME=ExportFileTxt

      - CONNECTOR_SCOPE=text/plain

      - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-import-file-stix:

    image: opencti/connector-import-file-stix:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=${CONNECTOR_IMPORT_FILE_STIX_ID} # Valid UUIDv4

      - CONNECTOR_TYPE=INTERNAL_IMPORT_FILE

      - CONNECTOR_NAME=ImportFileStix

      - CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import

      - CONNECTOR_SCOPE=application/json,text/xml

      - CONNECTOR_AUTO=true # Enable/disable auto-import of file

      - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-import-document:

    image: opencti/connector-import-document:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=${CONNECTOR_IMPORT_DOCUMENT_ID} # Valid UUIDv4

      - CONNECTOR_TYPE=INTERNAL_IMPORT_FILE

      - CONNECTOR_NAME=ImportDocument

      - CONNECTOR_VALIDATE_BEFORE_IMPORT=true # Validate any bundle before import

      - CONNECTOR_SCOPE=application/pdf,text/plain,text/html

      - CONNECTOR_AUTO=true # Enable/disable auto-import of file

      - CONNECTOR_ONLY_CONTEXTUAL=false # Only extract data related to an entity (a report, a threat actor, etc.)

      - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

      - IMPORT_DOCUMENT_CREATE_INDICATOR=true

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-alienvault:

    image: opencti/connector-alienvault:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=4d3c1dbf-b521-44b5-8d4d-c011554993b7

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - CONNECTOR_NAME=AlienVault

      - CONNECTOR_SCOPE=alienvault

      - CONNECTOR_CONFIDENCE_LEVEL50 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=false

      - CONNECTOR_LOG_LEVEL=info

      - ALIENVAULT_BASE_URL=https://otx.alienvault.com

      - ALIENVAULT_API_KEY=<API_KEY>

      - ALIENVAULT_TLP=White

      - ALIENVAULT_CREATE_OBSERVABLES=true

      - ALIENVAULT_CREATE_INDICATORS=true

      - ALIENVAULT_PULSE_START_TIMESTAMP=2020-05-01T00:00:00                  # BEWARE! Could be a lot of pulses!

      - ALIENVAULT_REPORT_TYPE=threat-report

      - ALIENVAULT_REPORT_STATUS=New

      - ALIENVAULT_GUESS_MALWARE=false                                        # Use tags to guess malware.

      - ALIENVAULT_GUESS_CVE=false                                            # Use tags to guess CVE.

      - ALIENVAULT_EXCLUDED_PULSE_INDICATOR_TYPES=FileHash-MD5,FileHash-SHA1  # Excluded Pulse indicator types.

      - ALIENVAULT_ENABLE_RELATIONSHIPS=true                                  # Enable/Disable relationship creation between SDOs.

      - ALIENVAULT_ENABLE_ATTACK_PATTERNS_INDICATES=true                      # Enable/Disable "indicates" relationships between indicators and attack patterns

      - ALIENVAULT_INTERVAL_SEC=1800

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-cybercrimetracker:

    image: opencti/connector-cybercrime-tracker:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=f48e3dbb-142b-4497-805f-be2feb364fa8

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - CONNECTOR_NAME=Cybercrime-Tracker

      - CONNECTOR_SCOPE=cybercrime-tracker

      - CONNECTOR_CONFIDENCE_LEVEL=15 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=false

      - CONNECTOR_LOG_LEVEL=info

      - CYBERCRIME_TRACKER_FEED_URL=http://cybercrime-tracker.net/rss.xml

      - CYBERCRIME_TRACKER_TLP=WHITE

      - CYBERCRIME_TRACKER_INTERVAL=86400

      - CYBERCRIME_TRACKER_CREATE_INDICATORS=true

      - CYBERCRIME_TRACKER_CREATE_OBSERVABLES=true

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  abuseipdb-ipblacklist:

    image: opencti/connector-abuseipdb-ipblacklist:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=ef2efb3c-1200-47e7-a40e-952b20b2ac5b # Valid UUIDv4

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - "CONNECTOR_NAME=AbuseIPDB IP Blacklist"

      - CONNECTOR_SCOPE=abuseipdb

      - CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

      - ABUSEIPDB_URL=https://api.abuseipdb.com/api/v2/blacklist

      - ABUSEIPDB_API_KEY=<API_KEY>

      - ABUSEIPDB_SCORE=100

      - ABUSEIPDB_LIMIT=10000

      - ABUSEIPDB_INTERVAL=2 #Day

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-mitre:

    image: opencti/connector-mitre:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=d1e314b6-7e09-42db-bd5d-19b9ca461f82

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - "CONNECTOR_NAME=MITRE Datasets"

      - CONNECTOR_SCOPE=marking-definition,identity,attack-pattern,course-of-action,intrusion-set,campaign,malware,tool,report,external-reference-as-report

      - CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=false

      - CONNECTOR_RUN_AND_TERMINATE=false

      - CONNECTOR_LOG_LEVEL=info

      - MITRE_ENTERPRISE_FILE_URL=https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json

      - MITRE_MOBILE_ATTACK_FILE_URL=https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/mobile-attack/mobile-attack.json

      - MITRE_ICS_ATTACK_FILE_URL=https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/ics-attack/ics-attack.json

      - MITRE_CAPEC_FILE_URL=https://raw.githubusercontent.com/mitre/cti/master/capec/2.1/stix-capec.json

      - MITRE_INTERVAL=7 # In days, must be strictly greater than 1

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-urlhaus:

    image: opencti/connector-urlhaus:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=7ff6b8fd-7a4c-4cdc-9f1d-c5a8ff65a724

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - "CONNECTOR_NAME=Abuse.ch URLhaus"

      - CONNECTOR_SCOPE=urlhaus

      - CONNECTOR_CONFIDENCE_LEVEL=40 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=false

      - CONNECTOR_LOG_LEVEL=info

      - URLHAUS_CSV_URL=https://urlhaus.abuse.ch/downloads/csv_recent/

      - URLHAUS_IMPORT_OFFLINE=true

      - URLHAUS_CREATE_INDICATORS=true

      - URLHAUS_INTERVAL=3 # In days, must be strictly greater than 1

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-urlscan:

    image: opencti/connector-urlscan:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=a21c6a2f-4862-451a-9fd5-65d483339675

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - CONNECTOR_NAME=Urlscan

      - CONNECTOR_SCOPE=urlscan

      - CONNECTOR_LOG_LEVEL=info

      - CONNECTOR_CONFIDENCE_LEVEL=40 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=false

      - CONNECTOR_CREATE_INDICATORS=true

      - CONNECTOR_TLP=white

      - CONNECTOR_LABELS=Phishing,Phishfeed

      - CONNECTOR_INTERVAL=86400 # seconds, 1d

      - URLSCAN_URL=https://urlscan.io/api/v1/pro/phishfeed?format=json&q=date:>now-1d

      - URLSCAN_API_KEY=<API_KEY>

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-vxvault:

    image: opencti/connector-vxvault:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=7abd828e-738d-4c88-ab16-9799e1432a98

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - "CONNECTOR_NAME=VX Vault URL list"

      - CONNECTOR_SCOPE=vxvault

      - CONNECTOR_CONFIDENCE_LEVEL=40 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=false

      - CONNECTOR_LOG_LEVEL=info

      - VXVAULT_URL=http://vxvault.net/URL_List.php

      - VXVAULT_CREATE_INDICATORS=true

      - VXVAULT_INTERVAL=3 # In days, must be strictly greater than 1

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  connector-shodan:

    image: opencti/connector-shodan:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=d7915b7f-8896-4e4b-a59b-c17a31ce5b34

      - CONNECTOR_TYPE=INTERNAL_ENRICHMENT

      - CONNECTOR_NAME=Shodan

      - CONNECTOR_SCOPE=IPv4-Addr

      - CONNECTOR_AUTO=true

      - CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_LOG_LEVEL=info

      - SHODAN_TOKEN=<API_KEY>

      - SHODAN_MAX_TLP=TLP:AMBER

      - SHODAN_CREATE_INDICATORS=true

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti

  # connector-greynoise:

  #   image: opencti/connector-greynoise:latest

  #   environment:

  #     - OPENCTI_URL=http://opencti:8080

  #     - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

  #     - CONNECTOR_ID=99097a3c-5795-404a-b195-2fabb83c89fd

  #     - CONNECTOR_TYPE=INTERNAL_ENRICHMENT

  #     - CONNECTOR_NAME=greynoise

  #     - CONNECTOR_SCOPE=ipv4-addr

  #     - CONNECTOR_AUTO=true

  #     - CONNECTOR_CONFIDENCE_LEVEL=80 # From 0 (Unknown) to 100 (Fully trusted)

  #     - CONNECTOR_LOG_LEVEL=info

  #     - GREYNOISE_KEY=<API_KEY>

  #     - GREYNOISE_MAX_TLP=TLP:AMBER

  #     - GREYNOISE_NAME=GreyNoise sensors

  #     - GREYNOISE_DESCRIPTION=GreyNoise collects and analyzes untargeted, widespread, and opportunistic scan and attack activity that reaches every server directly connected to the Internet.

  #     - GREYNOISE_SIGHTING_NOT_SEEN=false

  #     - GREYNOISE_SPOOFABLE_CONFIDENCE_LEVEL=30

  #   restart: always

  #   deploy:

  #     placement:

  #       constraints: [node.labels.dev == true ]

  #   depends_on:

  #     - opencti

  # connector-intezer-sandbox:

  #   image: opencti/connector-intezer-sandbox:5.3.17

  #   environment:

  #     - OPENCTI_URL=http://opencti:8080

  #     - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

  #     - CONNECTOR_ID=e617fe85-63c8-4f82-ae0b-da93032add1a

  #     - CONNECTOR_TYPE=INTERNAL_ENRICHMENT

  #     - "CONNECTOR_NAME=IntezerSandbox"

  #     - CONNECTOR_SCOPE=Artifact

  #     - CONNECTOR_AUTO=true # Enable/disable auto-enrichment of observables

  #     - CONNECTOR_CONFIDENCE_LEVEL=50 # From 0 (Unknown) to 100 (Fully trusted)

  #     - CONNECTOR_LOG_LEVEL=info

  #     - INTEZER_SANDBOX_API_KEY=ENTERYOURAPIKEYHERE

  #     - INTEZER_SANDBOX_FAMILY_COLOR=#0059f7 # Label color for family

  #     - INTEZER_SANDBOX_MALICIOUS_COLOR=#d90e18 # Label color for malicious verdict

  #     - INTEZER_SANDBOX_TRUSTED_COLOR=#d90e18 # And so on...

  #     - INTEZER_SANDBOX_UNKNOWN_COLOR=#ffff00

  #     - INTEZER_SANDBOX_SUSPICIOUS_COLOR=#f79e00

  #     - INTEZER_SANDBOX_MAX_TLP=TLP:AMBER

  #   restart: always

  #   deploy:

  #     placement:

  #       constraints: [node.labels.dev == true ]

  #   depends_on:

  #     - opencti

  # connector-ipinfo:

  #   image: opencti/connector-ipinfo:5.3.17

  #   environment:

  #     - OPENCTI_URL=http://opencti:8080

  #     - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

  #     - CONNECTOR_ID=56593e28-2886-455d-94f3-c84deddb2ad3

  #     - CONNECTOR_TYPE=INTERNAL_ENRICHMENT

  #     - CONNECTOR_NAME=IpInfo

  #     - CONNECTOR_SCOPE=IPv4-Addr

  #     - CONNECTOR_AUTO=true

  #     - CONNECTOR_CONFIDENCE_LEVEL=75 # From 0 (Unknown) to 100 (Fully trusted)

  #     - CONNECTOR_LOG_LEVEL=info

  #     - IPINFO_TOKEN=ENTERYOURAPIKEYHERE

  #     - IPINFO_MAX_TLP=TLP:AMBER

  #   restart: always

  #   deploy:

  #     placement:

  #       constraints: [node.labels.dev == true ]

  #   depends_on:

  #     - opencti

  connector-opencti:

    image: opencti/connector-opencti:latest

    environment:

      - OPENCTI_URL=http://opencti:8080

      - OPENCTI_TOKEN=${OPENCTI_ADMIN_TOKEN}

      - CONNECTOR_ID=21f7d068-3c55-4b52-96ca-64543e3f452e

      - CONNECTOR_TYPE=EXTERNAL_IMPORT

      - CONNECTOR_NAME=OpenCTI

      - CONNECTOR_SCOPE=marking-definition,identity,location

      - CONNECTOR_CONFIDENCE_LEVEL=90 # From 0 (Unknown) to 100 (Fully trusted)

      - CONNECTOR_UPDATE_EXISTING_DATA=true

      - CONNECTOR_RUN_AND_TERMINATE=false

      - CONNECTOR_LOG_LEVEL=info

      - CONFIG_SECTORS_FILE_URL=https://raw.githubusercontent.com/OpenCTI-Platform/datasets/master/data/sectors.json

      - CONFIG_GEOGRAPHY_FILE_URL=https://raw.githubusercontent.com/OpenCTI-Platform/datasets/master/data/geography.json

      - CONFIG_INTERVAL=7 # In days, must be strictly greater than 1

    restart: always

    deploy:

      placement:

        constraints: [node.labels.dev == true ]

    depends_on:

      - opencti



volumes:

  esdata:

  s3data:

  redisdata:

  amqpdata: