Skip to contentSkip navigation

Installation

Pull the public image from Docker Hub, add the connector container to your compose stack, and verify it registered.

OpenCTI
On this page (4)

Installation Documentation

Add the Whisper connector to an OpenCTI deployment you already run. The whole process is three steps: pull the image, add one service to your compose file, and verify the connector registered.

Before you start, check the Requirements.

1. Pull the image

The connector is published on Docker Hub under the official OpenCTI organization: opencti/connector-whisper. It's public — no registry account or token needed.

bash
docker pull opencti/connector-whisper:<version>

Replace <version> with the tag that matches your OpenCTI platform version, for example 7.260715.0. Available tags:

TagUse when
Platform version (for example 7.260715.0)Production. Pin the tag that matches your OpenCTI platform version.
latestThe most recent stable release. Only if you accept automatic updates on docker pull.
rollingThe latest development build. Pre-release validation only.

To confirm what you pulled:

bash
docker inspect opencti/connector-whisper:<version> \
  | jq -r '.[0].Config.Labels."org.opencontainers.image.version"'

2. Add the service to your compose file

Paste this into the compose file that runs your OpenCTI platform, on the same Docker network as the platform and RabbitMQ:

yaml
services:
  connector-whisper:
    image: opencti/connector-whisper:<version>
    restart: unless-stopped
    environment:
      - OPENCTI_URL=http://opencti:8080
      - OPENCTI_TOKEN=${OPENCTI_TOKEN}
      - CONNECTOR_ID=${CONNECTOR_ID}
      - WHISPER_API_URL=https://graph.whisper.security
      - WHISPER_API_KEY=${WHISPER_API_KEY}

Generate CONNECTOR_ID once with uuidgen and keep it stable across restarts; OpenCTI uses it to identify this connector instance. The Configuration page covers every variable, including the optional ones (scope, auto-enrichment, log level, TLP ceiling).

Then start it:

bash
docker compose up -d connector-whisper

The container runs as a non-root user and includes a built-in healthcheck, so docker ps shows its health state alongside your other services.

3. Verify the installation
  1. Check the logs: docker logs connector-whisper. On a good start you see the connector register and begin listening for jobs. Startup errors here are almost always a missing OPENCTI_URL, OPENCTI_TOKEN, or CONNECTOR_ID.
  2. In the OpenCTI UI, open Data → Ingestion → Connectors and confirm Whisper is listed as Started with the scope you configured.
  3. Optional, from the command line:
bash
curl -fsS -X POST http://localhost:8080/graphql \
  -H "Authorization: Bearer $OPENCTI_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"query":"{ connectors { name active connector_scope } }"}'

Next steps
PreviousRequirementsNextConfiguration