Saved filters in OpenCTI: build once, share with your team

Filtering turns a flood of threat intelligence in OpenCTI into something you can act on. It lets analysts, dashboards, feeds, and automations each zero in on exactly the relevant subset of data (by type, confidence, labels, or dates) instead of drowning in noise.

Yet building the right filter, one that precisely captures a specific threat actor or a particular set of indicators, for instance, requires time and expertise. Until now, users had to build their own filters from scratch for every view. With saved filters in OpenCTI, analysts can now create a filter once, save it, share it with the right members, and reuse it directly inside widgets.

You manage a saved filter in a single place, and everyone and every view using it stays up to date. This small feature has a big impact. It turns individual expertise into a shared, reliable, controlled foundation that helps improve consistency, adaptability, and collaboration across the platform, with everyone working from the same view of the data.

Why filtering keeps threat data relevant

OpenCTI instances often ingest thousands of entities daily (indicators, malware, threat actors, reports, and sightings), pulled in automatically from feeds, connectors, and Trusted Automated Exchange of Intelligence Information (TAXII) and Structured Threat Information Expression (STIX) sources. Without a way to narrow that down, analysts would be stuck scrolling through noise instead of focusing on what actually matters to their organization. Filtering helps in a few concrete ways:

• Cuts through volume to surface relevance. Analysts can filter on attributes such as entity type, confidence score, reliability of the source, labels, Traffic Light Protocol (TLP) marking definitions, or creation and modification dates to narrow a global knowledge base down to "indicators tagged detection with confidence above 70, created in the last 7 days," the exact slice that matters for a given investigation or team.
• Works across the platform, from search to playbooks. The same filtering logic is reused consistently across entity lists, investigation and knowledge graphs, custom dashboards and widgets, exports, background tasks, live streams, TAXII collections, CSV feeds, and automated triggers and playbooks. An analyst who defines a useful filter for a dashboard view can reuse the same logic to drive an automated notification or a data-sharing feed to a partner or downstream tool, such as a security information and event management (SIEM) platform, an endpoint detection and response (EDR) tool, or a firewall.
• Enables targeted sharing and dissemination. Filters let organizations share only relevant subsets of their knowledge base (for example, a TAXII collection containing just malware with a specific label, or indicators above a score threshold) rather than exposing the entire dataset. That keeps the signal clear for recipients and supports access control and confidentiality.
• Supports proactive alerting. Combined with triggers, filters let analysts get notified automatically when new intelligence matching their criteria (a specific threat actor, sector, or malware family) appears, rather than manually rechecking the platform.
• Lowers the barrier with natural language. With Natural Language Query, analysts don't need to know the exact filter syntax. They can now ask a question in plain language ("show me all ransomware indicators linked to APT29 in the last month"), and OpenCTI's AI generates the structured filters behind the scenes.

Filtering is the mechanism that lets the same underlying graph of threat data serve very different needs (analyst triage, executive dashboards, automated feeds, partner sharing), each tailored to what's relevant for that audience.

Build a filter once, reuse it across views

Saved filters in OpenCTI take filtering one step further. They turn individual, from-scratch filtering into a reusable, collaborative asset. Instead of every analyst recreating the same combination of entity types, labels, markings, or confidence thresholds, you can build a filter once and share it with the members or teams who need it.

Share saved filters with the right people

From any entity list view, build your filter as usual, then save it under a name people will recognize, and grant access to specific users, groups, or organizations. You control who gets access and how much:

• Can view: lets a member see and use the shared filter as is.
• Can manage: lets a member see, use, rename, manage sharing, and even delete the saved filter.

In any entity list view, you'll see the saved filters you created and the ones shared with you, all ready to use.

Control who can share and manage saved filters

OpenCTI gates filter sharing behind the "Share filters" capability. Without it, users can still view and use filters others share with them, so collaboration stays open by default. With it, users can also share their own saved filters, provided they created them or hold "can manage" access to that filter.

Every saved filter keeps an owner. The creator always retains "can manage" rights, and OpenCTI keeps at least one member with "can manage" access at all times, so a shared filter is never orphaned, even as team access and membership evolve.

The result is a model built for teams: open enough for genuine collaboration, yet controlled enough to help prevent unwanted changes to filters other teams depend on.

Reuse saved filters in OpenCTI dashboard widgets

Saved filters in OpenCTI also power your dashboards. You create and manage them in entity lists, and you can now use them in dashboard widgets and custom views. Widgets become consistent building blocks anchored on shared, governed definitions, rather than static, siloed snapshots.

Your dashboards travel well. When you duplicate a dashboard, every widget keeps its saved filter reference, so you don't need to rebuild the filtering logic from scratch. When you export a widget, dashboard, or custom view, or create a public dashboard, OpenCTI automatically replaces each saved filter reference with its content. With the content built in, your exports and public dashboards work even for recipients who don't have access to the underlying shared filters.

And because the saved filter remains the single source of truth, it stays reliable. Update it once, and every widget using it reflects the change automatically, with no manual rebuilding across dashboards. If a saved filter is deleted or no longer available, any widget relying on it can no longer display, and related exports or public dashboard creations fail. That safeguard keeps your content trustworthy rather than silently broken.

Keep every team on the same data definitions

Saving a filter, sharing it with the right people, and reusing it inside widgets changes how teams collaborate around data. Instead of each analyst or unit defining its own version of a selection, such as the relevant or critical attack patterns, teams can converge on shared, governed definitions. The benefits add up:

• Consistency at scale. The same filtering logic applies whether you're in an entity list or an executive dashboard, and across multiple widgets. A widget tracking "high-confidence ransomware indicators" uses the same filter logic everywhere it appears, whether it's on a SOC dashboard or an executive report.
• Alignment between teams. Each user's dashboards rest on the same underlying criteria, which leaves less room for confusion or contradictory numbers reaching decision-makers. Decision-makers can be confident that everyone is looking at the same data, the same way.
• Faster collaboration and easier access to complex filtering. Users can rely on named, shared, well-understood filters. They don't need to reinvent existing filters. They just need the right access.
• Automatic updates. If a saved filter is updated, every widget referencing it reflects that change, avoiding the manual rebuild of several dashboards.
• Controlled sharing. The capability-based access model and the "can view" and "can manage" rights help keep this collaboration safe and flexible.

Start with the filters your team rebuilds most

Threat intelligence has to move fast and stay trustworthy while multiple teams and organizations collaborate. Saved filters in OpenCTI turn your analysts' expertise into shared definitions that work at scale. Next time you build a filter worth keeping, save it, name it clearly, and share it with the people who need it.