Filigran (OpenCTI)
French open-source threat intelligence platform built on OpenCTI, with an enterprise edition for playbooks and AI-assisted reporting
Quick Overview
| Company | Filigran SAS |
|---|---|
| Category | Threat Intelligence Platforms |
| Headquarters | Paris, France |
| Founded | Not stated |
| EU Presence | Yes - France (EU) |
| Data Location | Your own infrastructure (Community Edition) or Filigran platform; region not stated on pages seen |
| Open Source | Apache 2.0 (Community Edition) |
| GDPR Compliant | Yes |
| Self-Hosting | Yes - open-source Community Edition |
| Main Features | STIX 2.1 data model, 400+ one-click integrations, custom dashboards, case management, automated playbooks (Enterprise Edition), priority intelligence requirements (Enterprise Edition), AI-assisted report generation |
| Pricing | Community Edition free; Enterprise Edition on request (30-day free trial on XTM Hub) |
| Best For | Security teams that want to own and host their threat intelligence platform |
| Replaces | Recorded Future, Anomali, ThreatQuotient |
Detailed Review
OpenCTI is the intelligence part of Filigran's XTM platform. The vendor describes it as a platform that unifies commercial feeds, open-source feeds, industry groups and internal tools in one STIX 2.1 data model, with dashboards and case management on top.
The code is public: the OpenCTI repository carries a licence file stating that the Community Edition is under the Apache License 2.0 and that Filigran SAS holds the copyright. The privacy policy names Filigran SAS in France as lead controller under GDPR.
Community and Enterprise Edition
The Community Edition is the open-source core. The vendor lists automated playbooks, priority intelligence requirements, FINTEL, AI-powered file imports, report generation and natural-language search as Enterprise Edition features, with a 30-day trial on XTM Hub.
That split lets a small team start free and add paid features later, but it also means some of the workflow features you see in demos are not in the free edition.
Integrations and data model
Filigran advertises more than 400 one-click integrations and a consistent STIX 2.1 model. Because the model is an open standard, intelligence exported from OpenCTI can move into other STIX-capable tools.
Dashboards and case management are included for turning intelligence into incident work, according to the product page.
Beyond intelligence
The XTM platform also covers adversarial exposure validation and cyber risk quantification, so OpenCTI can be the first step of a wider exposure programme. Teams that only want a feed manager can ignore those parts.
Limitations to Consider
Filigran runs a US subsidiary (Filigran Inc.) alongside the French company, and the privacy policy says the local entity may act as controller for people outside the EU, so check which entity signs your order. No prices are published for the Enterprise Edition. OpenCTI does not collect dark web content itself, so teams needing that should pair it with KELA or CYJAX.
Who Should Use Filigran (OpenCTI)
European security teams with analysts able to run a platform, who want an open standard and the option to self-host.
Pros and Cons
Pros
- Open-source Community Edition under Apache 2.0
- STIX 2.1 data model
- 400+ integrations advertised
- French lead controller under GDPR
- Free trial of Enterprise Edition
Cons
- Playbooks and PIRs only in Enterprise Edition
- Enterprise pricing not published
- Needs analyst time to operate
- US subsidiary exists, check the signing entity
Alternatives to Filigran (OpenCTI)
Other European threat intelligence platforms worth comparing before you decide:
EclecticIQ
Netherlands · Intelligence-first platform for the full threat intelligence lifecycle
Sekoia.io
France · SOC platform with threat intelligence built into detection
Silobreaker
United Kingdom · Intelligence engine across cyber, geopolitical and physical risk
CYJAX
United Kingdom · British cyber threat intelligence with analyst access
See all European threat intelligence platforms or compare them directly against Recorded Future on our alternatives page.
Frequently Asked Questions
The Community Edition is licensed under Apache 2.0 according to the licence file in the repository. Some features, such as playbooks, are listed as Enterprise Edition.
Yes, the Community Edition is open source and can be run on your own infrastructure.
The privacy policy names Filigran SAS in Paris as lead controller for GDPR, and also lists a US and an Australian entity for other locations.