Pulse Intelligence vs ThreatForge

Pulse Intelligence is an open-source, self-hosted threat intelligence workspace for analyst workflows. It organizes threat actors, aliases, campaigns, indicators, reports, sources, CVEs and ATT&CK mappings, and ingests public feeds including CISA KEV, NVD, FIRST EPSS, abuse.ch, OTX, vendor blogs and security news. Indicator enrichment uses OTX, AbuseIPDB and VirusTotal, with Redis-backed quota controls. Analysts can save hunts across indicator fields, receive alerts for new matches and export results as CSV, STIX 2.1, MISP JSON, or Snort and Suricata rules. Scheduled Markdown reports can cover new indicators, KEV additions, hunt alerts and feed health. A public read-only API with scoped keys supports integrations; its default limit is 120 requests per API key per 60-second window, and indicator pages are capped at 500. The project lists Argon2id passwords, database-backed session cookies, hashed API keys and an admin-only audit log. Deployment requires Node.js 20.9+, PostgreSQL 17 or compatible PostgreSQL, and a Redis-compatible server. Native and Docker Compose deployment paths are documented.

ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. It accepts IP addresses, domains, URLs, hashes, email addresses and CVEs, enriches observables from public sources, assigns explainable risk scores from 0 to 100 and produces Markdown reports. Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.

Brand monitoring can generate typosquatting variants and enrich findings with Certificate Transparency, DNS, MX, RDAP and certificate-age information. Alerts can be sent through Telegram, webhooks or SMTP, but channels work independently on a best-effort basis. The project documents Docker Compose deployment, a web UI served by the API and interactive API documentation. Community Edition costs nothing under AGPL-3.0-or-later; Enterprise has a 90-day trial, with price not listed. Community v0.11.1 is a preview, and its schema, API and UI may change before stable 1.0.