ThreatForge
ThreatForge: A broad free toolkit for IOC investigation, monitoring, reporting, and case work. Ranked #22 of 32 in Threat Intelligence Platforms by our editors (7.6/10); pricing: Free plan; best for small teams needing free IOC investigations.
At a glance
- Editor score7.6 / 10
- PricingFree plan
- Best forSmall teams needing free IOC investigations
- Free planYes
- Paid fromFree
- Indicator enrichmentYes
- Facts checked20 Sep 2026
Where it wins
- Free open-source IOC intake, enrichment, scoring, and reporting
- Cases include evidence, assignments, notes, and audit trails
- Brand monitoring, alerts, attack-surface, and credential intelligence
Where it doesn't
- Community Preview is not a stable 1.0 release
- Some premium capabilities require the commercial Enterprise overlay
- Its published integration set centers on public sources and listed services
Our verdict on ThreatForge
ThreatForge is an open-source cyber threat intelligence and digital risk protection platform for security analysts, SOC teams, fraud teams, and researchers. Its Community Edition covers IOC intake for IPs, domains, URLs, hashes, email addresses, and CVEs, then enriches observables with public threat-intelligence sources. Explainable risk scoring from 0 to 100, technical Markdown reports, investigation cases, evidence, notes, assignments, and audit trails give small teams a structured way to move from an indicator to a documented investigation. Web, API, and self-hosted deployment options broaden its fit, while Docker supports deployment of the Community Edition.
The strongest case for ThreatForge is breadth in a free open-source package. Alongside core investigation features, it includes brand monitoring, typosquatting detection, Certificate Transparency discovery, attack-surface intelligence, credential intelligence, and alerting through Telegram, webhooks, and SMTP. Integrations include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK, and EPSS/FIRST. Multi-tenant architecture and role-based access controls also give the product a useful foundation for teams handling separate environments or users. Teams looking for public-source enrichment and explainable investigation output should find the feature mix well aligned with day-to-day triage.
The main qualification is product maturity and edition structure. The public repository is a Community Preview rather than a stable 1.0 release, so organizations should account for that when evaluating operational adoption. A separate commercial Enterprise overlay adds premium capabilities, making edition selection part of the buying decision. ThreatForge suits small security, fraud, and research teams that want self-hosted or API-based IOC work without a paid Community Edition. Larger organizations requiring a mature release process, or teams whose workflow depends on integrations beyond the listed ecosystem, should compare alternatives before standardizing.
Your product? Our editors can test ThreatForge in depth and publish a review, labelled as paid · from $149/mo →
ThreatForge pricing
ThreatForge fact sheet
| Free plan | Yes |
|---|---|
| Paid from | Free |
| Indicator enrichment | Yes |
| STIX/TAXII support | Not verified |
| Report management | Yes |
| Workflow automation | Yes |
| Case management | Yes |
| Deployment | Self-hosted |
| Deployment | Self-hosted |
| Platforms | Web |
| Support | Email, Docs |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 7 integrations: CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK, EPSS/FIRST, Telegram, SMTP … |
| Pricing | Free plan |
| Website | github.com |
| Facts checked | 20 Sep 2026 |
ThreatForge integrations
ThreatForge lists 7 integrations on its own site.
- CISA KEV
- URLhaus/abuse.ch
- MITRE ATT&CK
- EPSS/FIRST
- Telegram
- SMTP
- Webhooks
Alternatives to ThreatForge
- Anomali PlatformA broad enterprise TIP combining intelligence operations, telemetry, cases, automation, and AI.9.3
- Recorded Future Intelligence CloudA broad intelligence platform for teams that need risk context across security workflows.9.2
- Group-IB Threat Intelligence PlatformA broad cloud platform for actor research, dark-web monitoring, leaks, and intelligence operations.9.0
See all ThreatForge alternatives →
Used ThreatForge? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used ThreatForge for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
ThreatForge is listed in our Threat Intelligence Platforms directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/threatforge/"><img src="https://www.itechguides.com/best/badge/threatforge.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update