Tech riderRev. 2 Oct 2026
ThreatForge
- 1Runs onAPI, self-hosted, Web
- 2CostsFree plan · free trial
- 3Indicator enrichmentYes
- 4Report managementYes
- 5Workflow automationYes
- 6Case managementYes
- 7Deploymentself-hosted
7 lines stated Written from the maker's own pages: github.com
Overview
ThreatForge is ranked #3 of 31 in threat intelligence platforms on Specifiction. It runs on API, Self-hosted, Web. There is a free plan. A free trial is offered.
ThreatForge plans and pricing
All plansEnterprise Edition Not published Commercial license · 90-day trial · commercial support and SLAs per agreement github.com · 2 Oct 2026
Compared on threat intelligence platforms
- Free plan
- Yesgithub.com
- Indicator enrichment
- Yesgithub.com
- Report management
- Yesgithub.com
- Workflow automation
- Yesgithub.com
- Case management
- Yesgithub.com
- Deployment
- self-hostedgithub.com
Facts
- Purpose
- ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation.github.com · 2 Oct 2026
- Intended users
- It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk.github.com · 2 Oct 2026
- IOC features
- It accepts IPs, domains, URLs, hashes, e-mails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and generates Markdown reports.github.com · 2 Oct 2026
- Public connectors
- Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.github.com · 2 Oct 2026
- Brand protection
- Brand monitoring includes typosquatting variation generation, Certificate Transparency discovery, DNS/MX/RDAP and certificate-age enrichment, and abuse scoring.github.com · 2 Oct 2026
- Alerts
- Outbound alerts can use Telegram, webhooks or SMTP, and each channel operates independently on a best-effort basis.github.com · 2 Oct 2026
- Integrations
- MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them.github.com · 2 Oct 2026
- Access controls
- The platform supports multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions.github.com · 2 Oct 2026
- Security
- The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting.github.com · 2 Oct 2026
- Notable limits
- Community email observables are intake-only in the MVP, and ThreatForge does not perform automatic takedowns.github.com · 2 Oct 2026
- Enterprise limits
- Community locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license; locked requests return HTTP 402.github.com · 2 Oct 2026
- Support
- The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support.github.com · 2 Oct 2026
- Release status
- The repository identifies Community v0.11.1 as a preview release and says its schema, API and UI may evolve before a stable 1.0.github.com · 2 Oct 2026
Best ThreatForge alternatives
See all 12 All accessCh 01 OpenAEV Free planFree trialAPI Free to start7.4 All accessCh 02 IBM X-Force Exchange Free planFree trialAPI Free to start7.3 All accessCh 04 Security Vision TIP APILinux 7.0 All accessCh 05 SOCRadar Extended Threat Intelligence Platform Free trialAPIWeb from $379.17/mo7.0 All accessCh 06 Group-IB Attack Surface Management Free trialAPIWeb 6.7 All accessCh 07 Flashpoint Ignite APIWeb 6.6
Where it ranks on Specifiction
Is ThreatForge yours?
Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.
Sources
- github.com/brunoaugusto1978/threatforge· checked 2 Oct 2026
- github.com/brunoaugusto1978/threatforge/blob/main/· checked 2 Oct 2026