OpenCTI
OpenCTI: A broad, extensible TIP with a free self-hosted edition and enterprise deployment options. Ranked #16 of 32 in Threat Intelligence Platforms by our editors (7.9/10); pricing: Free plan · 30-day trial; best for teams wanting an open, extensible TIP.
At a glance
- Editor score7.9 / 10
- PricingFree plan · 30-day trial
- Best forTeams wanting an open, extensible TIP
- Free planYes
- Indicator enrichmentYes
- Founded2022 · Paris, France
- Facts checked20 Sep 2026
Where it wins
- Free self-hosted Community Edition with a STIX 2.1 knowledge graph
- Broad ingestion, enrichment, reporting, cases, playbooks, and APIs
- Connectors for MISP, MITRE, Splunk, Elastic Security, and more
Where it doesn't
- Community Edition relies on self-hosting and community Slack support
- Enterprise features require a paid edition
- SaaS options are limited to Medium and Large resource tiers
Our verdict on OpenCTI
OpenCTI is an open-source cyber threat intelligence platform for security teams, government organizations, and enterprises. It structures, stores, correlates, visualizes, and shares technical and non-technical intelligence through a STIX 2.1 knowledge graph. The platform covers indicator enrichment, intelligence ingestion, threat reports, dashboards, exports, case management, workflow automation, and data sharing. Web, Linux, and API access support hybrid deployment, while the free self-hosted Community Edition gives teams a practical starting point.
Its breadth is a central strength. OpenCTI accepts intelligence through TAXII, RSS, CSV, JSON, connectors, and feeds, then supports enrichment through integrations such as MISP, MITRE datasets, CVE, AlienVault, Mandiant, Shodan, and DomainTools. Security operations teams can connect it with Splunk, Elastic Security, and QRadar. GraphQL APIs, data-sharing feeds, organization-based segregation, and role-based access control support broader intelligence workflows. AI-assisted imports, summaries, insights, and natural-language search add another way to work with collected information.
The plan structure separates self-managed access from commercial capabilities. Community Edition is free forever and includes the complete STIX 2.1 knowledge graph, open-source connectors, and community support on Slack. Enterprise Edition adds automated playbooks, Priority Intelligence Requirements, advanced RBAC, SSO, audit logging, and dedicated support. SaaS Medium and SaaS Large provide managed dedicated instances, include Enterprise Edition, and offer unlimited users, connectors, and integrations. Teams seeking control and extensibility should start with Community Edition; organizations needing managed hosting, advanced access controls, or dedicated support should consider the commercial options.
Your product? Our editors can test OpenCTI in depth and publish a review, labelled as paid · from $149/mo →
OpenCTI pricing
All 4 OpenCTI plans and prices →
OpenCTI fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Not verified |
| Indicator enrichment | Yes |
| STIX/TAXII support | Yes |
| Report management | Yes |
| Workflow automation | Yes |
| Case management | Yes |
| Deployment | Hybrid |
| Free trial | 30 days |
| Deployment | Cloud, Self-hosted |
| Platforms | Web, Linux |
| Compliance & security | SOC 2, ISO 27001, GDPR |
| Support | Email, Tickets, Community, Docs · 24/7 |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 10 integrations: MISP, MITRE datasets, CVE, AlienVault, Mandiant, Shodan … See all → |
| Pricing | Free plan · 30-day trial (source) |
| Website | filigran.io |
| Facts checked | 20 Sep 2026 |
OpenCTI integrations
OpenCTI lists 10 integrations on its own site.
- MISP
- MITRE datasets
- CVE
- AlienVault
- Mandiant
- Shodan
- DomainTools
- Splunk
- Elastic Security
- QRadar
See all OpenCTI integrations →
Alternatives to OpenCTI
- Anomali PlatformA broad enterprise TIP combining intelligence operations, telemetry, cases, automation, and AI.9.3
- Recorded Future Intelligence CloudA broad intelligence platform for teams that need risk context across security workflows.9.2
- Group-IB Threat Intelligence PlatformA broad cloud platform for actor research, dark-web monitoring, leaks, and intelligence operations.9.0
See all OpenCTI alternatives →
Used OpenCTI? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used OpenCTI for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
OpenCTI is listed in our Threat Intelligence Platforms directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/opencti/"><img src="https://www.itechguides.com/best/badge/opencti.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update