No. 3 of 31 ·Threat Intelligence Platforms

ThreatForge

Web · Self-hosted · API

Freedom report

Two barsScore 6.4

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely1 of 6 device platforms
DocumentedPlans, terms and facts published

ThreatForge is ranked #3 of 31 in threat intelligence platforms on Freedom251. It runs on API, Self-hosted, Web. There is a free plan. A free trial is offered.

ThreatForge plans and pricing

All plans

Community Edition Free Open source · AGPL-3.0-or-later github.com · 2 Oct 2026

Enterprise Edition Not published Commercial license · 90-day trial · commercial support and SLAs per agreement github.com · 2 Oct 2026

Compared on threat intelligence platforms

Free plan: Yes
Indicator enrichment: Yes
Report management: Yes
Workflow automation: Yes
Case management: Yes
Deployment: self-hosted

Best ThreatForge alternatives

See all 12

One bar OpenAEV Free tier No. 1Free6.5 One bar IBM X-Force Exchange Free tier No. 2Free6.4 One bar Security Vision TIP Paid plans No. 4—5.6 No signal SOCRadar Extended Threat Intelligence Platform Paid plans No. 5$379.17/mo5.5 No signal Anomali Platform Paid plans No. 6—5.4 No signal Flashpoint Ignite Paid plans No. 7—5.4

The record

Purpose: ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation.
Intended users: It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk.
IOC features: It accepts IPs, domains, URLs, hashes, e-mails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and generates Markdown reports.
Public connectors: Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.
Brand protection: Brand monitoring includes typosquatting variation generation, Certificate Transparency discovery, DNS/MX/RDAP and certificate-age enrichment, and abuse scoring.
Alerts: Outbound alerts can use Telegram, webhooks or SMTP, and each channel operates independently on a best-effort basis.
Integrations: MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them.
Access controls: The platform supports multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions.
Security: The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting.
Notable limits: Community email observables are intake-only in the MVP, and ThreatForge does not perform automatic takedowns.
Enterprise limits: Community locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license; locked requests return HTTP 402.
Support: The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support.
Release status: The repository identifies Community v0.11.1 as a preview release and says its schema, API and UI may evolve before a stable 1.0.
Price from: Free

Where it ranks on Freedom251

Best Threat Intelligence Platforms in 2026#3 of 31

Is ThreatForge yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote ThreatForge

Sources

github.com/brunoaugusto1978/threatforge· checked 2 Oct 2026
github.com/brunoaugusto1978/threatforge/blob/main/· checked 2 Oct 2026