shouldiuse.io

Categories

VERDICT

Filigran (OpenCTI / XTM) Review

Depends

Should I use Filigran (OpenCTI / XTM)?

Embrace a proactive approach with end-to-end cyber threat management, from anticipation to response. - opencti.io

· 1 month ago

Buy if you run a staffed SOC or threat-intel function and want an open-source, self-hostable platform with strong ratings. Skip it if you are a small team without dedicated security people — MISP or simpler tooling will do.

Confidence

Medium. Based on 20+ public sources; most review snippets were truncated, limiting verbatim user quotes. No named customer companies appeared in the evidence.

Ratings

  • Value for money
  • Ease of use
  • Feature depth
  • Support qualityNo evidence in reviewed sources
  • Security posture

Pricing

Free

Community Edition

ModelNot disclosed
Monthly feesNot disclosed
HardwareNot disclosed
Free tierYes
Enterprise EditionCustom quote (private AWS offer)

Best for

  • SOC and threat-intel teams
  • MSSPs managing multi-client intel
  • Orgs wanting self-hosted open-source TIP
  • Purple teams running attack simulations

Not for

  • Small businesses with no dedicated security staff
  • Teams wanting simple plug-and-play threat feeds
  • Buyers who need published, transparent pricing
  • Companies without analyst time to curate intel

Gotchas - check before you buy

high

Enterprise pricing is quote-only via private AWS Marketplace offers; no list prices

medium

G2 lists 5 pricing tiers; expect a demo call to learn your actual cost

medium

Open-source vs Enterprise feature split — check license gates before committing

low

SaaS pricing basis undisclosed on the official page

Pros and cons

Pros

  • Free, self-hostable open-source core before any purchase
  • 4.6/5 G2 seller rating across 49 reviews
  • Named Outperformer in 2026 GigaOm Threat Intelligence Radar
  • End-to-end suite: threat intel plus breach-and-attack simulation (OpenAEV)
  • Well-funded: $58M Series C signals staying power

Cons

  • No public pricing; enterprise sold via demo and private offers
  • Steep learning curve; multiple Reddit threads on just getting started
  • Newer OpenAEV product lacks enough G2 reviews to judge
  • Young company (founded 2022) with a rapidly expanding product line

Sources & method

- 17 sources - No known vulnerabilities found in the sources reviewed.

official x5review x7security x2news x3

Key stats

  • Value for money: 4/5

    Rating

  • Free

    Starting price

  • 17

    Sources

  • Analyzed

  • Value for money: 4/5. Free open-source core; paid tiers quote-only
  • Ease of use: 3/5. Multiple Reddit threads on learning curve
  • Feature depth: 4/5. End-to-end suite; GigaOm Radar Outperformer
  • Support quality. No evidence in reviewed sources
  • Security posture: 4/5. Publishes security page; open-source, auditable code
  • 4.6/5 G2 rating seller rating, 49 reviews
  • $58M Latest funding Series C, October 2025
  • Yes Free tier open-source community edition
  • 2022 Founded Paris, France

Pricing

Community Edition

Free

  • Open-source threat intel platform
  • Self-hosted

Enterprise Edition

Not disclosed

  • SaaS or self-hosted
  • Support and enterprise features

Security

No known vulnerabilities found in the sources reviewed.

What users say

Reddit threat-intel communities actively evaluate and debate OpenCTI as a TIP, and G2 reviewers rate Filigran 4.6/5.

Alternatives

Compare Filigran (OpenCTI / XTM) with each alternative.

  • MISP

    Free open-source TIP; simpler but rougher around the edges.

  • Anomali

    Commercial threat-intel rival; Filigran publishes its own comparison.

    Filigran (OpenCTI / XTM) vs Anomali
  • DomainTools Iris

    Investigation-focused intel tool, ranked alongside Filigran on PeerSpot.

Full analysis

Based on 20+ public sources; most review snippets were truncated, limiting verbatim user quotes. No named customer companies appeared in the evidence.

Credible open-source threat intel for staffed SOC teams; overkill and quote-only pricing for everyone else.

Methodology

Based on 20+ public sources; most review snippets were truncated, limiting verbatim user quotes. No named customer companies appeared in the evidence.

Read how a report is made.

Sources

  1. review
  2. review
  3. review
  4. official
  5. news
  6. news
  7. review
  8. review
  9. review
  10. official
  11. official
  12. official
  13. security
  14. security
  15. official
  16. review
  17. news

Add this review to your site

This check for Filigran (OpenCTI / XTM) says Depends.

Put the badge on your site.

Visitors see the independent review.

The link points here, and search engines follow it.

This is the badge visitors see on your site.

Paste one snippet. Keep the link as it is. A nofollow tag stops search engines from following it.

Rate this review

Anonymous. You can change your vote.

Loading votes…

Comments

One queue. No nested comments. Give a display name first. Limit: 200 words per comment and 7 comments per day. You can edit or delete yours.

Save a name to write a comment.

0 / 200 words

No comments yet.