opencti

OpenCTI is a platform for managing cyber threat intelligence. It structures the messy world of threat data (adversary TTPs, indicators, attribution) into the STIX2 standard, links every piece back to its source with a confidence level, and connects to MISP, TheHive, and MITRE ATT&CK. If your team drowns in threat feeds and spreadsheets, this is where that turns into a queryable knowledge graph. The community edition is Apache-2.0 and free.

Self-hosting is a real project. OpenCTI is not a single binary; it runs on a stack (Elasticsearch, a message broker, workers, the GraphQL API and web UI), typically via Docker Compose. Getting it stood up is manageable with the docs, but keeping it healthy (index sizing, connector management, upgrades) is ongoing work that assumes someone owns it.

For a security team that needs a real threat-intel backbone, the free edition covers the core platform and costs nothing in licensing. Solo analysts can run it but rarely need this much machinery. Larger orgs are the natural fit, and that is also where Filigran's proprietary Enterprise Edition comes in, adding features on top of the open core for a subscription.

The catch is operational weight versus payoff. OpenCTI earns its keep when you have enough threat data and enough analysts to justify a platform; run it for a handful of feeds and you have built a data center to store a filing cabinet. Size the deployment to your actual intel volume, not to how impressive the graph looks.