Feedback request: OpenCTI enrichment lab architecture

[Andrey Pautov (anpa1200)]

Hi OpenCTI community,

I built an OpenCTI-focused lab/reference project called The Intelligent Shield, and I would appreciate honest technical feedback from OpenCTI practitioners and developers.

The project explores how to move from basic CTI feed ingestion toward a more operational OpenCTI workflow for enrichment, investigation, ATT&CK context, and analyst-reviewed CTI processing.

Project links

• Documentation: The Intelligent Shield docs
• GitHub repository: opencti-intelligent-shield
• Article: The Intelligent Shield on Medium
• Portfolio / ecosystem: 1200km.com

What the project includes

• OpenCTI deployment structure
• Docker Compose-based setup
• core OpenCTI services and connector configuration
• standard CTI feed ingestion
• custom AI enrichment connector concept
• STIX / ATT&CK-oriented enrichment workflow
• investigation-oriented CTI usage
• operational notes around architecture, hardening, and analyst workflow

The goal is not to replace analyst judgment or OpenCTI-native workflows.

The main idea is to explore how OpenCTI can be used as a more actionable CTI knowledge graph for:

• enrichment
• investigation support
• ATT&CK-oriented context
• detection-oriented intelligence workflows
• analyst-reviewed CTI processing

Feedback I am looking for

I would really appreciate feedback on the architecture and integration approach:

1. Does this workflow make sense from a real OpenCTI operations perspective?
2. Is the enrichment connector approach aligned with how OpenCTI should be extended?
3. What would you change before treating this as a serious CTI lab/reference?
4. Are there better OpenCTI-native ways to represent AI-assisted enrichment results?
5. What are the main mistakes or anti-patterns you see in this approach?
6. Would this be more useful as:
   • an external enrichment service,
   • an OpenCTI connector,
   • a report-processing pipeline,
   • a demo lab,
   • or something else?

Important note

I am not presenting this as a production-ready platform. It is a research/lab project intended to explore OpenCTI deployment, enrichment, and operational CTI workflows.

I am mainly looking for honest technical review from people who work with OpenCTI in real environments.

Thanks in advance.