ThreatForge

Input—per 1M tokens

Output—per 1M tokens

Context—tokens

WeightsClosed

About

ThreatForge is ranked #4 of 31 in threat intelligence platforms on Inferse. It runs on API, Self-hosted, Web. There is a free plan. A free trial is offered.

Compared on threat intelligence platforms

Free plan: Yesgithub.com
Indicator enrichment: Yesgithub.com
Report management: Yesgithub.com
Workflow automation: Yesgithub.com
Case management: Yesgithub.com
Deployment: self-hostedgithub.com

Facts

Purpose: ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation.github.com · 2 Oct 2026
Intended users: It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk.github.com · 2 Oct 2026
IOC features: It accepts IPs, domains, URLs, hashes, e-mails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and generates Markdown reports.github.com · 2 Oct 2026
Public connectors: Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.github.com · 2 Oct 2026
Brand protection: Brand monitoring includes typosquatting variation generation, Certificate Transparency discovery, DNS/MX/RDAP and certificate-age enrichment, and abuse scoring.github.com · 2 Oct 2026
Alerts: Outbound alerts can use Telegram, webhooks or SMTP, and each channel operates independently on a best-effort basis.github.com · 2 Oct 2026
Integrations: MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them.github.com · 2 Oct 2026
Access controls: The platform supports multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions.github.com · 2 Oct 2026
Security: The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting.github.com · 2 Oct 2026
Deployment: The README documents Docker Compose deployment, a web UI served by the API and interactive API documentation.github.com · 2 Oct 2026
Notable limits: Community email observables are intake-only in the MVP, and ThreatForge does not perform automatic takedowns.github.com · 2 Oct 2026
Enterprise limits: Community locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license; locked requests return HTTP 402.github.com · 2 Oct 2026
Support: The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support.github.com · 2 Oct 2026
Release status: The repository identifies Community v0.11.1 as a preview release and says its schema, API and UI may evolve before a stable 1.0.github.com · 2 Oct 2026