From noise to knowledge: how OpenCTI sightings turn detections into defense

Millions of security events. Hundreds of alerts. And yet, many security teams still struggle to answer the one question that matters: What do I do next? Answering it takes context. When sightings are linked to intelligence, they stop being noise and start being signal, driving threat-informed defense, prioritized remediation, and measurable risk reduction. With OpenCTI sightings, high-volume detection data becomes context-rich intelligence that teams can act on.

Why STIX 2.1 matters for OpenCTI sightings

To understand how OpenCTI turns data into context-rich intelligence, start with the central role the Structured Threat Information Expression (STIX) format plays. Unlike traditional threat intelligence platforms (TIPs) that simply aggregate feeds and surface raw indicators, OpenCTI natively models all intelligence in STIX 2.1, the standardized language for describing and sharing cyber threat intelligence. As a result, OpenCTI can automatically correlate and enrich intelligence across sources, break down silos, and turn fragmented indicators into a structured, unified picture of the threat landscape that's ready for action.

Automated enrichment at this depth is significantly harder, and frequently out of reach, when intelligence is scattered across incompatible, proprietary formats.

What is a STIX 2.1 sighting?

In threat intelligence, a sighting is the recorded observation of something meaningful in your environment. That "something" could be an indicator (a forensic artifact pointing to a potential attack), an observable (a raw digital artifact not yet classified as malicious or benign), or a broader entity such as a known threat actor, malware family, or set of tactics, techniques, and procedures (TTPs). Sightings can originate from your internal logs and security tools, or be shared by trusted partner communities. In OpenCTI, each sighting links the observation to the threat intelligence that explains it.

A sighting typically represents one of three things:

• Detection: A security control blocked or detected a malicious artifact.
• Benign confirmation: Previously suspicious data is confirmed as safe.
• Contextual observation: An indicator or technique was seen but needs evaluation.

How sightings add context to indicators

To produce real insight, an indicator must be linked to a sighting, and then to an identity. Yet many organizations focus solely on indicator matching, tracking only what was detected without connecting it to who or why. That leaves them missing the threat context needed to turn detections into strategic intelligence.

In contrast, OpenCTI automatically links these relationships, helping analysts answer questions such as:

• Is this threat relevant to us right now?
• Is this behavior isolated, repeated, or spreading?
• Is this an emerging campaign or part of known adversary tradecraft?
• Where is our defensive posture strongest or weakest?

Why blocked indicators matter

Many platforms only record positive sightings, meaning they log when an indicator is seen in the environment but have no native mechanism to capture whether it was blocked, allowed, or actioned. In those cases, the distinction between a successful intrusion and a prevented one is lost entirely, leaving analysts without a complete picture of their defensive coverage.

Some platforms don't record blocked indicators at all, or record them outside the intelligence layer. That means important intelligence is missed, because blocked indicators can reveal threat actor reconnaissance and targeting patterns before they escalate.

In OpenCTI, blocked indicators are surfaced through sightings: When a security tool (such as a firewall or endpoint detection and response, or EDR, tool) observes and blocks an indicator, that event is recorded as a sighting, signaling that the threat was detected and stopped. Analysts get immediate visibility into which indicators are actively being blocked across their environment, directly within the intelligence context where the indicator lives.

OpenCTI also uses these sightings to confirm that specific threats are actively targeting your environment and that the indicator may still be active. Repeated sightings can extend an indicator's lifespan and score.

Blocked indicators may help you identify:

• Threat actor reconnaissance: which intrusion sets and adversary groups are probing your environment, revealing known adversary tradecraft or emerging campaign patterns
• Attack surface depth: where in your security stack indicators are being observed (perimeter firewalls, web proxies, email gateways, or deeper at endpoint protection layers), exposing your strongest and weakest defensive positions
• Behavioral patterns: whether threats are isolated incidents or repeated, coordinated attempts that indicate spreading campaigns
• Command-and-control activity: compromised assets attempting to establish persistence or exfiltrate data, even when connections are prevented

How inference rules connect sightings to threat actors

At the heart of OpenCTI's analytical power is its inference rule engine, which goes beyond simple indicator matching to automatically create relationships between intelligence objects. The engine reduces the need for analysts to connect the dots manually, and it surfaces insights that might otherwise be missed.

OpenCTI includes a native inference rule, "Inference of targeting via a sighting," which infers the targeting of an entity through a sighting of a specific indicator.

The inference rule analyzes OpenCTI sightings and automatically connects them to relevant malware, campaigns, or threat actors known to be associated with the sighted indicator.

For example:

• If your EDR detects an IP address previously attributed to an advanced persistent threat (APT) group, OpenCTI infers that the APT group may be targeting your organization, even if no one created that relationship manually.
• If a sighting is detected on an observable, OpenCTI automations can create or escalate an incident.

Inference elevates sightings from technical matches to strategic intelligence signals.

As the diagram above shows, when a malicious IP address is sighted in your environment, OpenCTI's inference rule engine automatically correlates the detection across your threat intelligence data, connecting the sighting to the threat actor, malware family, or attack techniques associated with that indicator. A single indicator detection becomes rich, contextual threat intelligence that reveals who is targeting you, what tools they're using, and how they operate.

Visualizing sightings in the Threat Sightings Dashboard

OpenCTI automatically contextualizes every threat actor, campaign, TTP, and vulnerability within a rich knowledge graph: a living, navigable picture of the threat landscape. As a result, teams can move beyond indicator matching to understand the full narrative of a threat: who, what, why, and how.

The Threat Sightings Dashboard that accompanies this post, available in XTM Hub, visualizes OpenCTI sightings from both internal detections and community-driven reports, so analysts and defenders can quickly derive tactical and strategic insights.

The dashboard is divided into three sections:

• Internal sightings: What's being detected inside your perimeter, and what it means.
• Community sightings: Comparative insight from Information Sharing and Analysis Centers (ISACs), Computer Emergency Response Teams (CERTs), Computer Security Incident Response Teams (CSIRTs), alliances, and trusted sharing groups.
• Data metrics: How healthy, relevant, and actionable your incoming intelligence is.

To use the dashboard with your own data, import it into your OpenCTI platform from XTM Hub.

Putting contextualized sightings to work

When OpenCTI correlates sightings with threat actors, campaigns, malware families, intrusion sets, MITRE ATT&CK techniques, and kill-chain phases, sightings evolve from simple observations into actionable, context-rich intelligence. That intelligence becomes a launchpad for:

• Threat hunting hypothesis development
• Detection engineering and continuous rule uplift
• Vulnerability prioritization based on active threat context
• Attack simulation, purple-team exercises, and security validation with platforms such as OpenAEV
• Defensive control tuning
• Executive-level risk reporting and heat mapping
• Strategic investment and capability planning
• Use-case development and refinement

Why sightings need intelligence

Sightings without intelligence are operationally inert. Analysts can't prioritize them effectively, indicators can't be correlated across incidents or campaigns, and there's no mechanism to validate or decay stale indicators of compromise (IOCs) over time. The result is alert fatigue, missed patterns, and detection without direction.

However, with strategic intelligence, teams can prioritize hunting, detection engineering, control tuning, and remediation based on what's active and relevant, not just what's noisy.

Ready to see how OpenCTI provides you with strategic intelligence? Get started with our Community Edition or sign up for a demo.