OpenCTI Platform
by Filigran SAS
OpenCTI is a modern open source threat intelligence platform built by Filigran — designed to structure, store, and visualize cyber threat intelligence using STIX 2.1 standards, offering the most advanced graph-based knowledge management of any open source threat intelligence platform with a commercial enterprise edition available.
Starting Price
Free (open source community edition); Filigran Enterprise Edition pricing on quote at filigran.io
G2
Gartner
Capterra
Ratings & Reviews
Key Features
- Open Source Threat Intelligence Platform — STIX 2.1 Native Architecture
- Graph-Based Knowledge Base — Entities
- Relationships
- TTPs Visualization
- OpenCTI Connectors — 100+ Automated Intel Ingestion Integrations
- MITRE ATT&CK
- CAPEC
- CVE Native Integration
- Threat Actor
- Campaign & Malware Relationship Mapping
- Diamond Model Analysis Framework
- Hunt & Detection Rules Export
- Automated IOC Enrichment via Connectors
- Multi-Tenancy Support
- REST & GraphQL API
- Role-Based Access Control (RBAC)
- Dashboard Builder — Custom Intelligence Views
- Filigran Enterprise Edition — SLA Support + Advanced Features
Pros & Cons
Pros
- +Most modern open source threat intelligence platform — STIX 2.1 native architecture from day one
- +Best graph-based relationship visualization of any open source or commercial TIP
- +100+ automated connectors ingest from MISP
- +VirusTotal
- +Shodan
- +Recorded Future automatically
- +Fastest-growing open source TIP community — 4
- +000+ GitHub stars
- +500+ contributors
- +Filigran Enterprise Edition provides commercial SLA for production deployments
- +EU-headquartered — GDPR compliant by design
- +Free tier has no feature limits — full platform capabilities available at zero cost
Cons
- −Newer platform — less battle-tested than MISP in large-scale government deployments
- −Requires technical expertise for self-hosted deployment and connector configuration
- −Commercial enterprise support requires Filigran Enterprise subscription
- −Smaller community than MISP (though fastest-growing)
- −GraphQL API has steeper learning curve than REST-only platforms
Best For
Enterprise CTI teams and government organizations wanting the most modern open source threat intelligence platform with STIX 2.1 native architecture, advanced graph-based relationship mapping, and 100+ automated intelligence connectors — with an optional Filigran Enterprise Edition for organizations needing commercial SLA support.
Target Audience
Enterprise CTI Teams, Government, CERTs, MSSPs, Security Researchers, Financial Services
Key Integrations
Competitor Tools
Pricing
Model
Open source — free self-hosted; Filigran Enterprise Edition on quote for SaaS and support
Starting At
Free (open source community edition); Filigran Enterprise Edition pricing on quote at filigran.io
Free Trial
Yes — free to deploy from GitHub; Filigran Enterprise demo at filigran.ioCompany Info
Founded
2019
Headquarters
Paris, France
Employees
150+
Company Size
All sizes — from small research teams to large enterprise CTI programs
Funding
Private — Series B; backed by Motier Ventures and Sekoia. Total raised: ~$35M (2024)
Certifications
Awards & Recognition
GitHub Security Category Trending 2025 | ENISA Recommended Open Source TIP 2025 | SC Awards Open Source Security Finalist 2025 | Gartner Peer Insights Notable Vendor — TIP 2025
Data sourced from G2, Gartner & Capterra · Verified by Firmographic