Kaspersky Threat Intelligence Portal vs ThreatForge
Kaspersky Threat Intelligence Portal
opentip.kaspersky.comThreatForge
github.comSide by side
| Figure | Kaspersky Threat Intelligence Portal | ThreatForge |
|---|---|---|
| Price from | Free | Free |
| Free plan | Yes | Yes |
| Free trial | Yes | Yes |
| Open source | — | — |
| Web | Yes | Yes |
| API | Yes | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 2 |
| Spec score · Threat Intelligence Platforms | 8.4 (#2) | 7.4 (#16) |
| Integrations | Kaspersky lists out-of-the-box connectors and a RESTful API, with integrations including IBM QRadar, Splunk Enterprise Security, MISP, and Maltego. | MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them. |
| Intended users | Kaspersky presents the portal for SOC teams, threat analysts, and threat hunters. | It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk. |
| Purpose | The portal is a centralized investigation workspace that gives security teams access to current cyberthreat intelligence. | ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. |
Plans
In their own words
Kaspersky Threat Intelligence Portal
Kaspersky Threat Intelligence Portal is a cloud investigation workspace that gives security teams access to current cyberthreat intelligence. Its tools support indicator enrichment, malware analysis, threat actor and campaign tracking, and incident response. Threat Lookup connects related threats in Kaspersky’s knowledge base, while Threat Analysis examines suspicious files using multiple analysis layers. AI features provide summaries for triage and investigation, actor profiles linking updated tactics, techniques, procedures, campaigns, and indicators in related reports, plus OSINT search and relationship tracing through KIRA. Remote MCP can connect compatible assistants such as Claude and ChatGPT to portal data. Users can look up IP addresses, hashes, domains, and web addresses; registered users can submit URLs to a sandbox for reports on page activity. The REST API supports URL lookups using a token and file submissions for sandbox analysis, with a documented maximum file size of 256 MB. Listed connectors include Maltego, MISP, Splunk Enterprise Security, IBM QRadar, and Elastic SIEM. Free access is available, with limited suspicious-file and URL executions. General access may show no data in some report sections; full reports require demo access.
ThreatForge
ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. It accepts IP addresses, domains, URLs, hashes, email addresses and CVEs, enriches observables from public sources, assigns explainable risk scores from 0 to 100 and produces Markdown reports. Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.
Brand monitoring can generate typosquatting variants and enrich findings with Certificate Transparency, DNS, MX, RDAP and certificate-age information. Alerts can be sent through Telegram, webhooks or SMTP, but channels work independently on a best-effort basis. The project documents Docker Compose deployment, a web UI served by the API and interactive API documentation. Community Edition costs nothing under AGPL-3.0-or-later; Enterprise has a 90-day trial, with price not listed. Community v0.11.1 is a preview, and its schema, API and UI may change before stable 1.0.