01 · Product name
OpenCTI
Open-source platform for storing and linking threat intelligence.
Published by Filigran.
In short
OpenCTI is an open-source threat-intelligence platform from Filigran. You can run the software from the public GitHub project. Filigran also offers a commercial path on the product page, with a demo rather than a price this listing could quote. The platform is where a team stores, links, and shares indicators. A relationship in the graph is only as good as the source that created it.
Product pricing strategy
02
Free and paid
OpenCTI’s software is open source. The GitHub project is the code you can run yourself. Filigran’s product page also sells a commercial path: Try OpenCTI and Book a demo. This listing did not find a public price card on that page, and it does not invent a seat price. Ask Filigran for the quote, or budget the servers if you host it.
Utility and features
03
Filigran’s product page describes OpenCTI as the place a security team unifies threat intelligence: collect it, correlate it, and hand it to operations. The same page points at a trial and a demo. The software itself is the OpenCTI-Platform repository on GitHub, and the documentation site covers deployment, connectors, and day-to-day use.
- A graph of intelligence. Indicators, reports, and the relationships between them. The product page’s pitch is correlation, not a single lookup.
- Connectors. The docs describe connectors that pull other sources in. Each connector is only as good as that source.
- Host it or buy the service. The repository is the open-source platform. The Filigran page is the commercial offer. They are not the same invoice.
Use it when indicators need a home and a graph, not when you need a one-off file verdict. VirusTotal still answers a hash. MISP still fits a community that already shares MISP events. Recorded Future is the commercial platform at the other end of the budget. OpenCTI is the open-source system you can host, with a company attached if you want them to run it.
- 1
Read the deployment docs if you are hosting it, or book the demo if you want Filigran to run it.
- 2
Connect one source you already trust, and check that its objects land with that source named.
- 3
Open a relationship and read why it exists before you put it in a report.
- 4
Keep VirusTotal or urlscan for the one-off artifact. OpenCTI is the system of record.
Caveats
04
A link in OpenCTI was written by a connector, a feed, or an analyst. Open the source object before you repeat the claim.
Self-hosting means you hold the data. A demo tenant is Filigran’s environment, with Filigran’s terms. Do not paste a sensitive incident into a trial you have not read.
Screenshots
05
Potential use cases
06
- A team needs one place for indicators from several feeds. Put them in OpenCTI as objects with the connector or the analyst named. The output is a graph you can query. A link was written by a connector, a feed, or a person. Open the source object before you repeat the claim. Pivot a hash to MISP if the team’s event workflow lives there, or to VirusTotal for an external opinion.
- You are tracing how a report, a malware family, and an address got linked. Walk the relationships and read the earliest object. The output is that chain, which may be an automated connector’s guess. Do not brief the picture without the source. Filigran’s demo tenant is their environment. Do not paste a sensitive incident into a trial you have not read.
- Another system should consume a structured object from the platform. Export or API-pull the object your integration expects, and keep OpenCTI as the source of the relationship. The output in the downstream tool should still say where it came from. Self-hosting means you hold the data and the backups. A cloud trial means they do.
Hard cases
The case where the first result is easy to over-read.
The connector drew an edge nobody will defend
The graph links a malware family to your supplier because a connector matched a string. Open the source object and see the match. If it is a weak string, delete or mark the relationship before anyone screenshots the graph. The platform’s job is correlation. Your job is to refuse the correlations you cannot explain. A demo tenant is the wrong place to discover this with real data.
Questions
Is OpenCTI free?
The software is open source and free to run yourself. Filigran sells a hosted or supported path. This listing does not quote that price.
Is OpenCTI the same product as MISP?
No. Both hold indicators. MISP is the sharing platform. OpenCTI is Filigran’s knowledge-graph platform, with its own connectors.
Citations
07
Titled sources. These public pages are what the quotes on this listing come from.
Product
OpenCTI product page
https://filigran.io/products/openctiDocumentation
OpenCTI documentation
https://docs.opencti.io/Documentation
OpenCTI repository
https://github.com/OpenCTI-Platform/opencti