ThreatForge

ThreatForge is an open-source platform for threat intelligence and digital risk investigation, combining observable enrichment with brand-abuse monitoring. It is best suited to security analysts, SOC and fraud teams, and researchers who need a self-hosted way to organize and prioritize investigations. Its Community edition spans a useful set of core tasks, but the preview release and Enterprise gates call for care before relying on it operationally.

Overview

The platform brings indicator investigation, brand monitoring, reporting and workflow automation together, with API and web access and a self-hosted deployment option. Docker Compose deployment is documented, and the API serves the web UI and interactive API documentation. That makes it a practical candidate for teams able to manage their own deployment; readers seeking a hosted service should look elsewhere.

Community is open source under AGPL-3.0-or-later and costs nothing. The repository identifies version 0.11.1 as a preview, with schema, API and UI subject to change before stable 1.0. That is a meaningful trade-off for teams integrating it into durable production workflows.

Key features

ThreatForge accepts IPs, domains, URLs, hashes, email addresses and CVEs, enriching observables from public sources and assigning explainable risk scores from 0 to 100. Markdown reports help preserve and share findings, while community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST. Community email observables are intake-only in the MVP, so teams should not treat email submissions as receiving the same analysis as other indicator types.

Brand monitoring generates typosquatting variations and combines Certificate Transparency discovery with DNS, MX, RDAP and certificate-age enrichment to support abuse scoring. This is useful for identifying suspicious lookalike domains, but ThreatForge does not carry out automatic takedowns; remediation remains the team's responsibility.

Telegram, webhook and SMTP outbound alerts can feed existing channels, but each operates independently on a best-effort basis. They can assist a workflow, not serve as a guaranteed notification mechanism. Multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions provide useful separation and accountability. The web UI also uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, security headers and login rate limiting.

MISP, OpenCTI and generic integrations appear as catalog entries and stubs in Community; Enterprise enables them. Community also locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license, and locked requests return HTTP 402. Those gates make the free edition a capable starting point, but not a substitute for the paid capabilities if those functions are central to a team's process.

Pricing

Community Edition

Community costs nothing and is open source under AGPL-3.0-or-later. It includes indicator enrichment, report management, workflow automation and case management, with community support. Its practical limits include intake-only email observables in the MVP, stubbed rather than enabled integrations, and Enterprise-locked PDF export, premium enrichment and inbound Telegram Intelligence.

Enterprise Edition

Enterprise has custom pricing and a 90-day trial. Its commercial license enables the gated capabilities and typically includes commercial support, SLAs and indemnification per agreement. It is the relevant option for organizations requiring those integrations or premium functions, but buyers should confirm the specific terms and license scope in their agreement.

Platforms

ThreatForge supports API, web and self-hosted use. Docker Compose is documented for deployment; the web interface is served by the API, which also provides interactive API documentation.

Who it's for

ThreatForge fits teams that want to enrich varied indicators, track potential brand abuse and organize investigations in a self-managed platform. Its explainable scoring, reports and access controls are useful for analyst workflows and separated tenants. It is a weaker fit for teams that need guaranteed alerts, automatic takedowns, full Community email analysis, or stable integrations and premium enrichment without an Enterprise license.

Pros and cons

• Pros: Free, open-source Community edition covers enrichment, reporting, workflow automation and case management.
• Pros: Explainable scoring and public-source connectors help analysts prioritize and contextualize indicators.
• Pros: Brand monitoring combines typosquatting generation and several discovery and enrichment methods.
• Cons: The 0.11.1 preview status means the schema, API and UI may change before 1.0.
• Cons: Alerts are best-effort, and automatic takedowns are not part of the platform.
• Cons: Several important functions, including integrations, PDF export and premium enrichment, require Enterprise.

Alternatives

For a broader comparison, browse Threat Intelligence Platforms. Choose OpenAEV instead when on-premise attack simulation and tabletop exercises are the priority. Choose IBM X-Force Exchange for limited access to its portal, but its free tier does not include X-Force API access. Security Vision TIP is a paid option with custom pricing.

SOCRadar Extended Threat Intelligence Platform may suit teams seeking paid domain monitoring plans, starting with its $600 a month Essential plan for 1 domain and 1 seat. ThreatQ is a paid platform requiring a license, with additional modules requiring license updates. Anomali Platform, Flashpoint Ignite and Intel 471 Verity471 are also alternatives with pricing by request or contact-sales terms.

Verdict

ThreatForge is a strong free starting point for security teams that want self-hosted indicator enrichment, explainable prioritization and brand-abuse investigation in one platform. Choose Community if its preview status and feature gates are acceptable; look elsewhere or evaluate Enterprise if dependable alerts, automatic remediation or stable, enabled integrations are essential.