Skip to content
SPECIFICTION
Get listed

ThreatForge

github.com

Free plan WebAPISelf-hosted
Visit github.com
Spec score 7.4 #16 of 32 in Threat Intelligence Platforms

What it is

ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. It accepts IP addresses, domains, URLs, hashes, email addresses and CVEs, enriches observables from public sources, assigns explainable risk scores from 0 to 100 and produces Markdown reports. Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.

Brand monitoring can generate typosquatting variants and enrich findings with Certificate Transparency, DNS, MX, RDAP and certificate-age information. Alerts can be sent through Telegram, webhooks or SMTP, but channels work independently on a best-effort basis. The project documents Docker Compose deployment, a web UI served by the API and interactive API documentation. Community Edition costs nothing under AGPL-3.0-or-later; Enterprise has a 90-day trial, with price not listed. Community v0.11.1 is a preview, and its schema, API and UI may change before stable 1.0.

Spec sheet

Purpose
ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation.Read 2 Oct 2026 · github.com
Intended users
It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk.Read 2 Oct 2026 · github.com
Deployment
The README documents Docker Compose deployment, a web UI served by the API and interactive API documentation.Read 2 Oct 2026 · github.com
Integrations
MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them.Read 2 Oct 2026 · github.com
Security
The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting.Read 2 Oct 2026 · github.com
Support
The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support.Read 2 Oct 2026 · github.com
Access controls
The platform supports multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions.Read 2 Oct 2026 · github.com
Alerts
Outbound alerts can use Telegram, webhooks or SMTP, and each channel operates independently on a best-effort basis.Read 2 Oct 2026 · github.com
Brand protection
Brand monitoring includes typosquatting variation generation, Certificate Transparency discovery, DNS/MX/RDAP and certificate-age enrichment, and abuse scoring.Read 2 Oct 2026 · github.com
Enterprise limits
Community locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license; locked requests return HTTP 402.Read 2 Oct 2026 · github.com
IOC features
It accepts IPs, domains, URLs, hashes, e-mails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and generates Markdown reports.Read 2 Oct 2026 · github.com
Notable limits
Community email observables are intake-only in the MVP, and ThreatForge does not perform automatic takedowns.Read 2 Oct 2026 · github.com
Public connectors
Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.Read 2 Oct 2026 · github.com
Release status
The repository identifies Community v0.11.1 as a preview release and says its schema, API and UI may evolve before a stable 1.0.Read 2 Oct 2026 · github.com

Plans and prices

Community Edition Free Open source · AGPL-3.0-or-later Read 2 Oct 2026 · github.com
Enterprise Edition Priced on request Commercial license · 90-day trial · commercial support and SLAs per agreement Read 2 Oct 2026 · github.com

Every ThreatForge plan and price →

Strong points and limits

Strong points

  • Enriches observables from public sources.
  • Risk scores are explainable and range from 0 to 100.
  • Brand monitoring includes typosquatting variation generation.
  • Supports multi-tenant isolation and tenant-scoped API keys.

Limits

  • Community email observables are intake-only in the MVP.
  • It does not perform automatic takedowns.
  • Alert channels are best-effort and operate independently.
  • Community is a preview release whose interfaces may change.

Who it suits

It is aimed at security analysts, SOC teams, fraud teams and researchers organizing indicators, investigating digital risk or monitoring brand abuse.

Verdict

ThreatForge Community offers indicator enrichment, brand monitoring and risk scoring at no charge. Consider its preview status, best-effort alerts and the limits on Community integrations and features before relying on it.

Where Specifiction places it

Alternatives to ThreatForgeAll alternatives →

MISP From €0.61/mo · Free plan 9.0 Visit