ThreatForge

Overview

ThreatForge is an open-source threat intelligence and digital risk platform for investigating indicators and monitoring brand abuse. It suits security analysts, SOC and fraud teams, and researchers who want a self-hosted way to enrich observables and prioritize risk. Its Community edition is a broad free starting point, but the preview release and Enterprise-only capabilities make it a cautious choice for operational dependence.

Key features

Analysts can submit IPs, domains, URLs, hashes, emails, and CVEs for enrichment from public sources. Explainable scores from 0 to 100 help prioritize investigation, while Markdown reports give findings a shareable format. Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK, and EPSS/FIRST. Email observables are intake-only in the Community MVP, so teams needing fuller email analysis should not assume the same enrichment coverage as for other indicators.

Brand monitoring generates typosquatting variations and combines Certificate Transparency discovery with DNS, MX, RDAP, and certificate-age enrichment to score abuse. This makes ThreatForge relevant to teams watching for domain impersonation, though it does not perform automatic takedowns. Telegram, webhook, and SMTP alerts can connect findings to existing channels, but each works best-effort and independently; they are not a guaranteed notification path.

Multi-tenant isolation, tenant and platform roles, tenant-scoped API keys, and audit logs for sensitive actions provide useful separation for teams. The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, security headers, and login rate limiting. Docker Compose deployment, an API-served web UI, and interactive API documentation support self-hosted and API-oriented use.

Community includes indicator enrichment, report management, workflow automation, and case management. MISP, OpenCTI, and generic integrations appear as catalog entries and stubs rather than enabled integrations in that edition, limiting its fit for teams that require those connections without an Enterprise license.

Pricing

Community locks PDF export, premium enrichment, and inbound Telegram Intelligence; requests for those features return HTTP 402. Its free price is attractive for evaluation and self-hosting, but the preview release and these gates make it less suitable when those capabilities are essential. Enterprise also includes commercial support, SLAs, and indemnification per agreement; Community receives community support.

Platforms

ThreatForge supports API, self-hosted, and web use. Docker Compose deployment and a web UI served by the API make it a practical option for teams comfortable operating their own service.

Who it's for

Choose ThreatForge if your security, SOC, fraud, or research team wants one self-hosted platform for public-source indicator enrichment, explainable scoring, brand-abuse monitoring, and reporting. Look elsewhere if you need automatic takedowns, dependable alert delivery, full Community email-observable analysis, or integrations and premium capabilities without an Enterprise license. Community v0.11.1 is identified as a preview, and its schema, API, and UI may change before a stable 1.0.

Pros and cons

• Pro: Community covers enrichment, scoring, brand monitoring, reports, workflows, and case management at no cost.
• Pro: Tenant isolation, scoped API keys, role controls, and audit logs support separated team use.
• Con: The preview status means the schema, API, and UI may evolve before stable 1.0.
• Con: Best-effort alerts and the lack of automatic takedowns limit its role in time-critical response.
• Con: Enterprise gates PDF export, premium enrichment, inbound Telegram Intelligence, and enabled MISP/OpenCTI integrations.

Alternatives

For a broader directory of options, see Threat Intelligence Platforms.

• OpenAEV is a free Community Edition option for on-premise attack simulation and tabletop exercises, making it a better fit when those activities are the priority.
• IBM X-Force Exchange offers a free portal tier, but without X-Force API access; choose it when limited portal access is enough.
• Security Vision TIP uses sales-based individual pricing, a fit for buyers evaluating a paid TIP by modules, connectors, event volume, nodes, and support needs.
• SOCRadar Extended Threat Intelligence Platform has paid monitoring plans including $600 a month for 1 domain and 1 seat, or $1,145 a month for its Business tier; consider it when a priced dark-web monitoring plan better matches your requirements.
• Flashpoint Ignite uses pricing by request.
• ThreatQ requires licensed, non-perpetual platform access, with additional modules requiring license updates.
• Anomali Platform directs buyers to contact sales for pricing.
• Intel 471 Verity471 directs buyers to contact sales for a demo and product information.

Verdict

ThreatForge is a strong candidate for analysts and smaller security teams that want free, self-hosted indicator enrichment and brand-risk investigation with explainable scoring. Its broad Community toolkit is the main reason to choose it; look elsewhere if your operation depends on guaranteed alerts, automated takedowns, stable-release assurances, or Enterprise-gated integrations and enrichment.