OpenCTI integration guide.

Check the ingestion features and data model

This guide was reviewed against OpenCTI 7.261026.0 on 2026-10-26. Use a maintained, patched release with the built-in CSV feed ingester, CSV mappers and working import workers. Older versions have different navigation and connector requirements; this is not a compatibility guarantee for every 6.x or 7.x build.

Use the existing plain-text lists as one-column CSV input without a header. Import addresses as IPv4-Addr observables. They represent published blocklist membership, not automatic indicators of successful exploitation. The reviewed CSV reader accepts line-oriented content from the URL; the public filenames do not need a new extension or a conversion service.

Allocate capacity for both complete feeds, overlapping observables, indexing and the import queue. Create a dedicated ingestion service account and a Data-Shield author organization. Use your assessed source confidence and appropriate markings; the Critical profile is not a confidence score or a CVE severity.

Configure separate Standard and Critical feeds

Standard

112,177 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_data-shield_ipv4_blocklist.txt

Critical

121,738 unique IPv4 addresses in this published snapshot.

https://raw.githubusercontent.com/duggytuxy/Data-Shield_IPv4_Blocklist/refs/heads/main/prod_critical_data-shield_ipv4_blocklist.txt

Published 26 Oct 2026, 21:31 UTC. Check live counts and SHA-256.

Create two ingesters named Data-Shield Standard and Data-Shield Critical, each with its corresponding URL. Authentication for these public feeds is None. Keep TLS certificate verification enabled. The reviewed creation form exposes this setting; a successful mapping preview alone does not establish that a complete scheduled retrieval validated TLS.

In the current UI, open Integrations → Available and create a CSV feed. The official ingestion guide describes creating, starting and monitoring it. Select the native 1 hour schedule for each feed. The reviewed schedule selector offers one or six hours, but no two-hour preset. Hourly retrieval checks for the latest publication; it does not change Data-Shield's two-hour generation cadence.

Map column A to the IPv4 value

Under Data → Processing → CSV Mappers, create one mapper for each profile, or use the inline mapper. Follow the CSV mapper reference and use the following settings:

Create reference representations for the author and label, then attach them to the observable representation. Test the mapper on a small reviewed sample first. An existing IP may be shared by both profiles: retain both provenance labels instead of creating a fabricated second address.

Run the feed verification preview and check the first row, value type and provenance. The preview is bounded and is not a full-file import test. Start the ingesters, inspect their work in Integrations → Deployed and wait for the import queue to finish. Compare the successfully processed rows with each downloaded file, allowing for deduplication into existing observables.

Correlate observables with dated evidence

Open an imported IPv4 observable and inspect its existing reports, relationships and sightings. OpenCTI uses deterministic observable identifiers for deduplication, so the same address from another source can connect to existing knowledge. Shared value does not make every report about that address equally recent or reliable.

1. Search the exact IP in Data-Shield CTI and inspect Follow the evidence. Record the profile, evidence source, original reference and observation window when available.
2. Create an analyst-reviewed report or note referencing the observable and any explicitly associated CVE. Preserve whether the claim is an observed attempt, a provider association or an unconfirmed exposure candidate.
3. Include the snapshot source commit and retrieval time separately from event dates. Keep the original evidence reference so another analyst can assess the claim.
4. Correlate with your own authorized telemetry before creating a sighting or promoting the record to a detection indicator. A CISA KEV match supplies CVE-level context, not attribution to this IP.

The two raw feeds contain only addresses. This setup does not automatically import attack types or CVE relationships. The existing public snapshot provides additional evidence in its own schema, not a STIX bundle or TAXII endpoint. Automated enrichment requires a separately reviewed mapping that preserves those distinctions; do not point a STIX importer at that JSON.

Handle refreshes and removals explicitly

The reviewed ingestion manager imports changed content and can skip unchanged data. Its CSV path does not reconcile missing rows by deleting historical observables. A profile label therefore means the address was imported from that profile, not that it is still blocked today.

Before treating a match as current, recheck the complete published list or the checksum-verified membership on the Data-Shield site. If your workflow requires automatic current-membership reconciliation, maintain a separate dated membership record under a reviewed adapter; do not delete a shared observable or unrelated reports when an address disappears. Stopping an ingester also leaves imported knowledge in place.

Monitor the last successful retrieval, parser failures, rejected rows, queue backlog and complete-feed capacity. Verify an added IP, an IP present in both profiles and a removed IP after a later refresh. Native ingestion does not itself compare the feed with the published SHA-256. Follow the shared evidence and freshness checks before using correlations for a security decision.