MISP vs ThreatForge
MISP
misp-project.orgThreatForge
github.comSide by side
| Figure | MISP | ThreatForge |
|---|---|---|
| Price from | €0.61/mo | Free |
| Free plan | Yes | Yes |
| Free trial | — | Yes |
| Open source | Yes | — |
| Web | Yes | Yes |
| Linux | Yes | — |
| API | Yes | Yes |
| Self-hosted | Yes | Yes |
| Plans published | 7 | 2 |
| Spec score · Threat Intelligence Platforms | 9.0 (#1) | 7.4 (#16) |
| Deployment | MISP can run on-premises, in the cloud or as a SaaS deployment. | The README documents Docker Compose deployment, a web UI served by the API and interactive API documentation. |
| Intended users | The project says MISP is designed for incident analysts, security and ICT professionals, and malware reversers. | It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk. |
| Purpose | MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. | ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. |
| Security | MISP supports signing and encrypting notifications with GnuPG or S/MIME, and signing and validating shared information. | The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting. |
| Support | Core issues are tracked on GitHub and community support is available through MISP Gitter channels. | The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support. |
Plans
MISP
- MISP coreFree
- MISP softwareFree
- Yearly support contract€7.31 a year
- Sustainability support€10.97 a year
- Support contract with sustainability support€18.28 a year
- Closed training in LuxembourgPrice not published
- On-site closed trainingPrice not published
In their own words
MISP
MISP is an open source platform for collecting, storing, distributing, and sharing cybersecurity indicators and threat information for incident and malware analysis. It is designed for incident analysts, security and ICT professionals, and malware reversers. Analysts can correlate information using fuzzy hashes and CIDR overlaps, then add comments, sightings, opinions, proposals, or counter-analysis. Distribution levels and custom sharing groups control access down to individual attributes, and instances can synchronize intelligence in real time. MISP supports signing and encrypting notifications with GnuPG or S/MIME, as well as signing and validating shared information. Automation options include an OpenAPI-described REST API, PyMISP, Python enrichment modules, and ZMQ or Kafka streaming. Import and export formats include STIX 1 and 2, OpenIOC, CSV, Suricata, Snort, and Zeek. MISP can run on-premise, in the cloud, or as SaaS, and the project recommends Ubuntu 24.04 or misp-docker for deployment. The software costs nothing under AGPL. Paid yearly support, sustainability support, and training options are also listed.
ThreatForge
ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. It accepts IP addresses, domains, URLs, hashes, email addresses and CVEs, enriches observables from public sources, assigns explainable risk scores from 0 to 100 and produces Markdown reports. Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.
Brand monitoring can generate typosquatting variants and enrich findings with Certificate Transparency, DNS, MX, RDAP and certificate-age information. Alerts can be sent through Telegram, webhooks or SMTP, but channels work independently on a best-effort basis. The project documents Docker Compose deployment, a web UI served by the API and interactive API documentation. Community Edition costs nothing under AGPL-3.0-or-later; Enterprise has a 90-day trial, with price not listed. Community v0.11.1 is a preview, and its schema, API and UI may change before stable 1.0.