Deploy OpenCTI 7 Threat Intelligence Platform

Deploy and Host OpenCTI with Railway

OpenCTI is an open-source platform for structuring, storing and sharing cyber threat intelligence as a STIX 2.1 knowledge graph. This community template deploys the full OpenCTI 7 stack on Railway: the platform, three workers, Elasticsearch, Redis, RabbitMQ, a Railway Bucket for files, and the ten built-in connectors from the official Docker setup.

About Hosting OpenCTI

OpenCTI's platform serves the web UI and GraphQL API and stores its knowledge graph in Elasticsearch. Redis holds caches and live event streams, RabbitMQ distributes work, and S3-compatible storage keeps uploaded reports and exports. Workers consume the queues and write data through the API, and connectors import or export data. This template follows the official docker-compose service by service, pins every image to the same release, generates all credentials, stores files in a Railway Bucket instead of MinIO, and loads the MITRE ATT&CK and OpenCTI reference datasets on first start.

Common Use Cases

• Building a central threat intelligence knowledge base for a SOC or CERT team
• Mapping threat actors, campaigns and malware to MITRE ATT&CK techniques
• Importing PDF and HTML threat reports and extracting indicators and observables
• Sharing curated intelligence as STIX 2.1 bundles, CSV or TAXII feeds
• Connecting external feeds and enrichment services through OpenCTI connectors

Dependencies for OpenCTI Hosting

• OpenCTI platform, worker and connectors 7.261008.0 (official opencti/* images)
• Elasticsearch 8.19
• Redis 8.2 (Railway Redis)
• RabbitMQ 4.3 with the management plugin
• S3-compatible object storage (Railway Bucket)

Deployment Dependencies

• OpenCTI Docker setup (official compose this template follows): https://github.com/OpenCTI-Platform/docker
• OpenCTI documentation, installation and configuration: https://docs.opencti.io/latest/deployment/installation/
• OpenCTI connectors catalog: https://github.com/OpenCTI-Platform/connectors
• Railway Storage Buckets: https://docs.railway.com/storage-buckets

Implementation Details

First login: wait until the OpenCTI service is healthy, open its public URL and log in with APP__ADMIN__EMAIL (default admin@opencti.io, change it before the first deploy if you like) and the generated APP__ADMIN__PASSWORD from the OpenCTI service variables. Change the password in your profile. MITRE ATT&CK and the OpenCTI datasets start importing immediately; on the very first start these two connectors may restart once or twice while their service accounts are created.

Adding connectors: OpenCTI's connector manager normally starts containers through Docker, which Railway does not offer. Add each extra connector as its own Railway service with the image opencti/connector-{name}:7.261008.0, OPENCTI_URL and OPENCTI_TOKEN copied from an existing connector, a new UUIDv4 CONNECTOR_ID, and the connector's own settings from the connectors catalog.

Scaling: raise the OpenCTI Worker replica count for faster ingestion. Give Elasticsearch more memory together with a larger ES_JAVA_OPTS heap, and the platform more memory together with NODE_OPTIONS, as your knowledge base grows.

E-mail: OpenCTI sends notifications over SMTP only. Add SMTP__HOSTNAME, SMTP__PORT, SMTP__USERNAME, SMTP__PASSWORD and SMTP__USE_SSL to the OpenCTI service; Railway allows outbound SMTP on the Pro plan.

Versions: every OpenCTI image is pinned to 7.261008.0. Upgrade by changing the tag on the platform, worker and all connectors together; the platform migrates its data on start. OpenCTI also publishes an LTS line if you prefer fewer upgrades.

Why Deploy OpenCTI on Railway?

OpenCTI needs several cooperating services. Railway runs them all in one project with private networking, persistent volumes, a managed S3 bucket and an HTTPS domain, so the complete stack, with reference data loaded, comes up from one template. You can scale workers and give Elasticsearch more resources from the dashboard as your intelligence grows.