Filigran (OpenCTI / XTM)
Depends
Confidence: Medium
Buy if you run a staffed SOC or threat-intel function and want an open-source, self-hostable platform with strong ratings.
Comparison
Filigran (OpenCTI / XTM) vs MISP Open Source Threat Intelligence Platform
Filigran (OpenCTI / XTM) and MISP Open Source Threat Intelligence Platform both land on Depends.
MISP Open Source Threat Intelligence Platform
Depends
Confidence: Medium
Adopt it if you run a security team or CSIRT that collects and shares threat indicators and can self-host.
| Compare | Filigran (OpenCTI / XTM) | MISP Open Source Threat Intelligence Platform |
|---|---|---|
| Verdict | Depends | Depends |
| Best for | SOC and threat-intel teams | CSIRTs and CERT teams |
| Who it's not for | Small businesses with no dedicated security staff | Small teams without dedicated security staff |
| Privacy | No known public vulnerabilities found in the sources reviewed.13 | Transparent disclosure culture; fixes within ~48 hours; several historical XSS/auth CVEs, all patched. |
| Support quality | No evidence in reviewed sources | Community default; commercial support sold separately. |
| Public sentiment | Reddit threat-intel communities actively evaluate and debate OpenCTI as a TIP, and G2 reviewers rate Filigran 4.6/5.¹ | The one practitioner quote found calls it a favorite, flexible open source tool for intel feeds when set up correctly. |
| Biggest gotcha | Enterprise pricing is quote-only via private AWS Marketplace offers; no list prices10 | Free license, real cost is admin time: setup, tuning, syncs, patching. |
Pick Filigran (OpenCTI / XTM) when
- SOC and threat-intel teams
- MSSPs managing multi-client intel
- Orgs wanting self-hosted open-source TIP
- Purple teams running attack simulations
When Filigran (OpenCTI / XTM) is not a fit
- Small businesses with no dedicated security staff
- Teams wanting simple plug-and-play threat feeds
- Buyers who need published, transparent pricing
- Companies without analyst time to curate intel
Pick MISP Open Source Threat Intelligence Platform when
- CSIRTs and CERT teams
- Critical infrastructure security teams
- Threat intel sharing communities
- Malware analysts tracking IOCs
When MISP Open Source Threat Intelligence Platform is not a fit
- Small teams without dedicated security staff
- Anyone wanting plug-and-play SaaS
- Organizations that can't self-host and patch
- Buyers needing vendor SLAs by default
Sources
review
official
- Filigran Raises $58 Million in Series C Fundingsecurityweek.comnews
- OpenCTI maker Filigran raises $16Mtechcrunch.comnews
review
- Trying to Learn OpenCTI . Redditreddit.comreview
- OpenCTI Enterprise Edition . private AWS offeraws.amazon.comofficial
- OpenCTI Enterprise Editionfiligran.ioofficial
- Software as a Servicefiligran.ioofficial
- Product security pageopencti.iosecurity
- Filigran CVEs and Security Vulnerabilities . OpenCVEopencve.alliance.unm.edusecurity
- Filigran vs. Anomali: A Comparative Analysisfiligran.ioofficial
- DomainTools Iris vs Filigran comparisonpeerspot.comreview
