Modular. Extensible. Easy to run.
Inspired by OASIS CTI standards STIX and TAXII, EclecticIQ Platform is a multi-tier, distributed Linux-based system built in Python using the latest cutting-edge technologies and mature open-source components.
Internals: REST APIs. Redis in-memory data structures. JSON data format built with Flask. Celery framework for asynchronous task queuing. Gunicorn WSGI HTTP server. NGINX high-performance HTTP server.
Data Layer: Built with 'polyglot persistence' that switches between PostgreSQL for main data storage and Elasticsearch and Neo4j for specialized use cases including full-text search and graph traversal.
CTI Data Model: Entities are based on EclecticIQ's interpretation of STIX 1.2, resulting in a precisely-crafted set of patterns, idioms and decisions informed by experience working with real-world data and clients.
Observables Data Model: A separate data model for Observables supports data fusion and greater depth of connections between disparate data points.
Graphical User Interface (GUI): A fully-developed GUI expands the role of the CTI analyst.
Command Line Interface (CLI): Supports simple integration and scripting tasks.
REST API: Supports integration with enterprise platforms, third-party solutions and scripting applications.
Python API: Build your own extensions for incoming/outgoing feeds and enrichments.