Integrating UniqueSignal with OpenCTI Using STIX/TAXII 2.1
OpenCTI is one of the most widely used open-source platforms for managing cyber threat intelligence. It gives CTI teams, SOC analysts, and threat hunters a structured environment to collect, organize, enrich, and operationalize intelligence.
One of the reasons OpenCTI is especially useful for threat intelligence feeds is its strong support for STIX 2.1 and TAXII 2.1. OpenCTI has a well-designed data model that aligns closely with STIX 2.1 concepts such as indicators, observables, malware, attack patterns, reports, identities, locations, and relationships. It also includes a mature TAXII client that makes it straightforward to ingest external intelligence feeds.
This makes OpenCTI a natural fit for consuming UniqueSignal, VMRay’s malware threat intelligence feed delivered through STIX/TAXII 2.1.
This guide explains how to add UniqueSignal as a TAXII feed in OpenCTI.
What is UniqueSignal?
UniqueSignal is a malware-focused threat intelligence feed built from VMRay’s malware analysis capabilities. Instead of providing a generic list of indicators, UniqueSignal delivers structured intelligence that helps analysts understand malware-related activity in context.
Depending on the available intelligence, UniqueSignal can include:
-
File hashes
-
Domains
-
URLs
-
IP addresses
-
Malware family context
-
Related observables
-
Behavioral analysis context
-
MITRE ATT&CK technique mappings
-
Reports and relationships between objects
-
Victimology context such as affected industries or locations, when available
Because the feed is delivered in STIX 2.1 over TAXII 2.1, OpenCTI can ingest the data in a structured way and preserve the relationships between the different intelligence objects.
This is important because threat intelligence is much more useful when analysts can pivot from one object to another. For example, an analyst may start with a suspicious domain, then move to the related malware family, associated file hashes, observed behaviors, MITRE ATT&CK techniques, and related reports.
Why integrate UniqueSignal with OpenCTI?
Many teams already use OpenCTI as their central threat intelligence platform. By integrating UniqueSignal into OpenCTI, teams can bring malware intelligence directly into their existing CTI workflows.
This helps teams:
-
Centralize malware intelligence inside OpenCTI
-
Ingest indicators and context through a standard STIX/TAXII workflow
-
Correlate UniqueSignal data with other internal and external intelligence sources
-
Investigate indicators with malware family and behavioral context
-
Use OpenCTI relationships to pivot between indicators, observables, malware, attack patterns, and reports
-
Make the intelligence available to downstream tools connected to OpenCTI
The goal is not only to import indicators, but to make UniqueSignal intelligence usable in daily investigation, enrichment, and threat hunting workflows.
Integration steps
Step 1: Go to Ingestion in OpenCTI
In the OpenCTI left-side navigation menu, click Ingestion.
This is the main area where OpenCTI manages different data intake methods.
On the right hand side you will see options such as:
-
Connectors catalog
-
OpenCTI Streams
-
TAXII Feeds
-
TAXII Push
-
RSS Feeds
-
CSV Feeds
-
JSON Feeds
-
Form intakes
For UniqueSignal, select TAXII Feeds because the feed is delivered through TAXII 2.1.
Step 2: Open TAXII Feeds
Inside the Ingestion section, click TAXII Feeds.
This page is used to manage TAXII-based feed ingestion. From here, you can add a new TAXII feed, configure the TAXII server, select the collection, and define the authentication method.
Click Create TAXII Feed.
Step 3: Create the UniqueSignal TAXII feed
After clicking Create TAXII Feed, OpenCTI opens the Create a TAXII ingester form.
Start by filling in the basic feed information.
Name
Use:
Description
Use:
UniqueSignal Malware Threat Intelligence Feed
This makes the feed easy to recognize for analysts and administrators inside OpenCTI.
Step 4: Add the TAXII server URL
In the TAXII server URL field, enter the UniqueSignal TAXII server URL.
Example:
https://cti-taxii.vmray.com
This is the endpoint OpenCTI will connect to in order to retrieve available TAXII collections and ingest STIX 2.1 content.
Make sure the URL is entered exactly as provided with your UniqueSignal access details.
Step 5: Select TAXII 2.1
In the TAXII version field, select:
This step is important. UniqueSignal is delivered using STIX/TAXII 2.1, so OpenCTI must be configured to communicate with the feed using the correct TAXII version.
Selecting the wrong TAXII version may prevent OpenCTI from connecting to the feed or reading the collection correctly.
Step 6: Select the TAXII collection
In the TAXII Collection field, enter or select the collection ID provided with your UniqueSignal credentials.
Example:
1DEFDCF2-943F-14E5-8B6F-E22405935442
The exact collection ID may be different for your environment, subscription, or trial. Use the collection value provided by VMRay.
The collection tells OpenCTI which specific set of intelligence objects it should ingest from the TAXII server.
In the Authentication type field, select:
Then enter the username and password provided with your UniqueSignal TAXII feed access.
Username
Example:
4BEC2241-02FC-417D-8A3B-32E4220F65B4
Password
Enter the password provided with your feed credentials.
OpenCTI will mask the password after it is entered.
Step 8: Set the confidence level
After entering the authentication details, set the confidence level to:
We recommend setting the confidence level to 100 because UniqueSignal is not an unverified third-party indicator dump. The feed is carefully curated by VMRay and is based on malware analysis results, enrichment, normalization, and quality control.
This allows OpenCTI users to treat the ingested intelligence as high-confidence data from a trusted source.
This helps OpenCTI users understand why the feed is being assigned a high confidence value.
Step 9: Create the TAXII feed
After completing the required fields, click:
OpenCTI will save the UniqueSignal TAXII feed configuration.
At this point, the feed has been created, but ingestion may not start automatically depending on your OpenCTI setup.
Step 10: Start the TAXII feed
After the feed is created, go back to the TAXII Feeds list.
Find the newly created UniqueSignal feed.
Click the three-dot menu on the right side of the feed row.
Then click:
This starts the TAXII ingestion process.
OpenCTI will now connect to the UniqueSignal TAXII server, authenticate with the provided credentials, access the selected TAXII collection, and begin ingesting STIX 2.1 threat intelligence objects.
What you should see after ingestion
Once ingestion is successful, UniqueSignal content should start appearing as structured CTI data inside OpenCTI.
Depending on the feed content, analysts may see objects such as:
This allows analysts to investigate intelligence in a connected way.
For example, instead of only seeing a domain or hash as an isolated IOC, an analyst may be able to understand:
-
Which malware family it is associated with
-
Which report it came from
-
Which other observables are related
-
Which behaviors were observed
-
Which ATT&CK techniques are relevant
-
Whether the intelligence overlaps with other sources already stored in OpenCTI
This is where the combination of UniqueSignal and OpenCTI becomes especially useful. UniqueSignal provides malware-centered intelligence, while OpenCTI gives teams the graph-like investigation environment to explore and operationalize that intelligence.
Example analyst workflow
A typical workflow may look like this:
-
UniqueSignal ingests a new malware-related indicator into OpenCTI.
-
An analyst opens the indicator in OpenCTI.
-
The analyst reviews the related observables, malware family, report, and ATT&CK context.
-
The analyst checks whether the indicator overlaps with internal telemetry or other intelligence sources.
-
The analyst uses OpenCTI relationships to pivot into connected infrastructure or related malware activity.
-
The intelligence is then used for alert enrichment, threat hunting, reporting, or downstream security workflows.
This workflow is much stronger than simply importing indicators into a flat list. The value comes from preserving context and relationships.
Conclusion
OpenCTI and UniqueSignal work well together because both are designed around structured threat intelligence.
OpenCTI provides a STIX 2.1-compatible data model, strong relationship handling, and a well-designed TAXII ingestion workflow. UniqueSignal delivers malware-focused threat intelligence through STIX/TAXII 2.1, including indicators, malware context, behavioral insights, and related intelligence objects.
By connecting UniqueSignal to OpenCTI as a TAXII 2.1 feed, CTI and SOC teams can move beyond isolated indicators and work with malware intelligence in context.
This gives analysts a more useful way to investigate threats, pivot between related objects, enrich alerts, support threat hunting, and operationalize intelligence across their security workflows.
