Skip to content

XTM One

XTM One is the AI platform of the Filigran eXtended Threat Management (XTM) suite. When OpenAEV is registered with XTM One, it unlocks the AI features of OpenAEV. See the XTM One documentation to deploy XTM One.

What it enables

  • Enterprise Edition: an XTM license on XTM One can grant Enterprise Edition to OpenAEV. See Enterprise Edition.
  • Ask Ariane: the AI assistant in the top bar, and the CTEM Command Center link. Ask Ariane also turns your OpenAEV data into a report, a presentation or a video (a validation readout, a deck for a review meeting, an attack path explained). Each one shows as a card in the conversation, which opens it in XTM One and downloads it through OpenAEV as PDF, PowerPoint or MP4.
  • Ask AI: generate or improve text in some form fields.
  • Scenario assistant: generate TTPs from a threat report or a file. See Scenario assistant.
  • Detection rules: generate detection rules from an executed Inject. See Inject result.
  • Phishing: generate email templates with AI. See Email templates.
  • Autonomous attack: the orchestrator of autonomous attack chaining runs in XTM One. See Autonomous attack.
  • MCP server: use OpenAEV from MCP clients. See MCP server.

Connect OpenAEV to XTM One

  1. Set the XTM One URL and the registration token defined in XTM One in the OpenAEV configuration:

    Parameter Environment variable Description
    openaev.xtm.one.url OPENAEV_XTM_ONE_URL XTM One URL, as reachable from OpenAEV (an internal address works)
    openaev.xtm.one.token OPENAEV_XTM_ONE_TOKEN XTM One registration token

  2. If XTM One reaches OpenAEV on another address than its public URL, set OPENAEV_API_URL on the XTM One side.

  3. Restart OpenAEV. It registers with XTM One at startup, then every 5 minutes.
  4. Check that the Ask Ariane button appears in the top bar. Most AI features also need Enterprise Edition.

See Configuration for how the two platforms authenticate each other.

What's next?