- Home
- Threat Intelligence Platforms
- ThreatForge
ThreatForge
What it is
ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation. It is described for security analysts, SOC teams, fraud teams and researchers. The platform accepts IPs, domains, URLs, hashes, emails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and creates Markdown reports. Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST. Brand monitoring can generate typosquatting variants and add Certificate Transparency, DNS, MX, RDAP and certificate-age context. Alerts can use Telegram, webhooks or SMTP, though each channel works independently on a best-effort basis. Docker Compose deployment, a web UI served by the API and interactive API documentation are documented. Community is free under AGPL-3.0-or-later. The Community release is marked as a preview, so its schema, API and UI may evolve before a stable 1.0. Community email observables are intake-only in the MVP, and the platform does not perform automatic takedowns.
For and against
For
- Free Community edition under AGPL-3.0-or-later
- Enriches observables from public sources
- Includes explainable risk scores and Markdown reports
- Supports Telegram, webhook and SMTP alerts
Against
- Community release is a preview
- Community email observables are intake-only
- Does not perform automatic takedowns
The verdict
ThreatForge provides indicator enrichment, brand monitoring and reporting in a free open-source Community edition. Keep in mind that Community is a preview release and lacks automatic takedowns.
Who it suits
ThreatForge may suit security analysts, SOC teams, fraud teams and researchers who need to organize indicators, enrich observables and monitor brand abuse. Its deployment options may appeal to teams seeking a self-hosted platform.
Plans and prices
Community Edition
Open source · AGPL-3.0-or-later
Read 2 Oct 2026 · github.com
Enterprise Edition
Commercial license · 90-day trial · commercial support and SLAs per agreement
Read 2 Oct 2026 · github.com
On the record
- Access controls
- The platform supports multi-tenant isolation, tenant and platform roles, tenant-scoped API keys and audit logs for sensitive actions.github.com · read 2 Oct 2026
- Alerts
- Outbound alerts can use Telegram, webhooks or SMTP, and each channel operates independently on a best-effort basis.github.com · read 2 Oct 2026
- Brand protection
- Brand monitoring includes typosquatting variation generation, Certificate Transparency discovery, DNS/MX/RDAP and certificate-age enrichment, and abuse scoring.github.com · read 2 Oct 2026
- Deployment
- The README documents Docker Compose deployment, a web UI served by the API and interactive API documentation.github.com · read 2 Oct 2026
- Enterprise limits
- Community locks PDF export, premium enrichment and inbound Telegram Intelligence behind an active Enterprise license; locked requests return HTTP 402.github.com · read 2 Oct 2026
- Integrations
- MISP, OpenCTI and generic integrations are listed as catalog entries and stubs in Community, while the Enterprise edition enables them.github.com · read 2 Oct 2026
- Intended users
- It is described as helping security analysts, SOC teams, fraud teams and researchers organize indicators, enrich observables, monitor brand abuse and prioritize risk.github.com · read 2 Oct 2026
- IOC features
- It accepts IPs, domains, URLs, hashes, e-mails and CVEs, enriches observables from public sources, calculates explainable risk scores from 0 to 100 and generates Markdown reports.github.com · read 2 Oct 2026
- Notable limits
- Community email observables are intake-only in the MVP, and ThreatForge does not perform automatic takedowns.github.com · read 2 Oct 2026
- Public connectors
- Community connectors include CISA KEV, URLhaus/abuse.ch, MITRE ATT&CK and EPSS/FIRST.github.com · read 2 Oct 2026
- Purpose
- ThreatForge is an open-source CTI and Digital Risk Protection platform for threat monitoring, brand protection and digital risk investigation.github.com · read 2 Oct 2026
- Release status
- The repository identifies Community v0.11.1 as a preview release and says its schema, API and UI may evolve before a stable 1.0.github.com · read 2 Oct 2026
- Security
- The web UI uses JWT sessions in httpOnly and SameSite=Strict cookies, Argon2id password handling when available, and web security headers and login rate limiting.github.com · read 2 Oct 2026
- Support
- The commercial license typically includes commercial support, SLAs and indemnification per agreement; the comparison describes Community support as community support.github.com · read 2 Oct 2026
