ThreatForge

7.5easy start · #3 of 31
in Threat Intelligence Platforms

Free to practise onyes
Free trialyes
Well documentedyes
Runs where you worknot on record

Runs on api, self-hosted, Web.

ThreatForge is ranked #3 of 31 in threat intelligence platforms on The Geeks Club. It runs on API, Self-hosted, Web. There is a free plan. A free trial is offered.

ThreatForge plans and pricing

All plans

Community Edition Free Open source · AGPL-3.0-or-later github.com · 2 Oct 2026

Enterprise Edition Not published Commercial license · 90-day trial · commercial support and SLAs per agreement github.com · 2 Oct 2026

Compared on threat intelligence platforms

Free plan: Yes
Indicator enrichment: Yes
Report management: Yes
Workflow automation: Yes
Case management: Yes
Deployment: self-hosted

Best ThreatForge alternatives

See all 12

OpenAEV 0 of 4 in the starter kit Lesson 17.7 IBM X-Force Exchange 0 of 4 in the starter kit Lesson 27.6 SOCRadar Extended Threat Intelligence Platform 0 of 4 in the starter kit Lesson 47.1 Group-IB Attack Surface Management 0 of 4 in the starter kit Lesson 56.7 Security Vision TIP 0 of 4 in the starter kit Lesson 66.7 Flashpoint Ignite 0 of 4 in the starter kit Lesson 76.4

The record

Purpose: ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation.
Intended users: It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk.
IOC features: It accepts IPs, domains, URLs, hashes, e-mails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and generates Markdown reports.
Public connectors: Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.
Brand protection: Brand monitoring includes typosquatting variation generation, Certificate Transparency discovery, DNS/MX/RDAP and certificate-age enrichment, and abuse scoring.
Alerts: Outbound alerts can use Telegram, webhooks or SMTP, and each channel operates independently on a best-effort basis.
Integrations: MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them.
Access controls: The platform supports multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions.
Security: The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting.
Notable limits: Community email observables are intake-only in the MVP, and ThreatForge does not perform automatic takedowns.
Enterprise limits: Community locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license; locked requests return HTTP 402.
Support: The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support.
Release status: The repository identifies Community v0.11.1 as a preview release and says its schema, API and UI may evolve before a stable 1.0.
Price from: Free

Where it ranks on The Geeks Club

Best Threat Intelligence Platforms in 2026#3 of 31

Is ThreatForge yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote ThreatForge

Sources

github.com/brunoaugusto1978/threatforge· checked 2 Oct 2026
github.com/brunoaugusto1978/threatforge/blob/main/· checked 2 Oct 2026