OpenCTI is Filigran’s open-source cyber threat intelligence platform: a STIX 2.1 knowledge graph for actors, malware, campaigns, observables and the relationships between them. MISP is the long-running open-source threat sharing platform from the MISP Project — events, attributes, objects, taxonomies and galaxies for collecting, correlating and exchanging intelligence with trusted communities. Both are free to self-host in community form. Both show up in blue-team stacks that have outgrown a spreadsheet of indicators. We read the project sites, manuals, licences and current release notes. Checked on 28 October 2026.
Documentation review: not tested. We have not used the products in this review. It is a structured reading of published evidence, linked throughout. How we review products explains what that covers.
Status: correct as at 28 October 2026. OpenCTI Community Edition and MISP core are free under open-source licences; there is no commercial list price for those community builds. OpenCTI also ships a separately licensed Enterprise Edition in the same codebase.
Disclosure: no vendor sponsored, reviewed or saw this review before publication, and there are no affiliate links. Our independence policy explains how we work.
Verdict
Pick OpenCTI when you need a STIX-native knowledge graph and case-style analysis workspace; pick MISP when you need community sharing, distribution controls and battle-tested indicator exchange. Many CTI programmes run both and sync them.
- Good for: OpenCTI suits teams that want actors, intrusion sets, malware, ATT&CK techniques and indicators as linked STIX objects with dashboards, connectors and investigation graphs. MISP suits teams that live in events and attributes, need granular sharing groups, sync with peer instances, and export IDS or SIEM feeds without ceremony.
- Not for: OpenCTI Community Edition is a poor sole choice if your primary need is multi-organisation sharing with distribution levels and sharing groups as first-class workflow — that is MISP’s home turf. MISP is a poor sole choice if you want a full STIX 2.1 knowledge hypergraph with Filigran-style investigation UI at the centre of the analyst day; its pitch centres sharing and structured IOCs more than a TIP knowledge graph.
- Price: OpenCTI Community Edition is licensed under Apache License 2.0 (opens in a new tab); Enterprise Edition features in the same repository sit under Filigran’s separate Enterprise licence. MISP core is licensed under AGPL-3.0-or-later (opens in a new tab). Hardware, databases, connectors and any paid feeds are separate costs.
- Score: No numeric score (documentation review)
What each project is
Filigran’s OpenCTI product pages (opens in a new tab) describe it as an open-source threat intelligence platform that unifies commercial feeds, open sources, industry groups and internal tools into a STIX 2.1 knowledge graph. The public FAQ states that Community Edition is Apache License 2.0 with source on GitHub, and that Enterprise Edition capabilities ship in the same codebase under a separate Filigran licence. The OpenCTI documentation overview (opens in a new tab) walks the analyst UI as hot knowledge (analyses, cases, events, observations) and cold knowledge (threats, arsenal, techniques, entities, locations) — encyclopaedia plus daily intake, not a flat IOC list.
MISP’s project site (opens in a new tab) describes it as an open-source threat intelligence platform and open standards stack for sharing. The features page (opens in a new tab) emphasises structured indicators and objects, correlation, taxonomies and galaxies (including MITRE ATT&CK), granular distribution and sharing groups, instance synchronisation, a REST API with PyMISP, enrichment modules, and exports including MISP JSON, STIX 1 and 2, Suricata, Snort and Zeek. The project history (opens in a new tab) records roots in CyDefSIG (2011), the MISP rename with NATO involvement, and later stewardship with CIRCL and a volunteer community; CIRCL’s MISP service page (opens in a new tab) still presents it as community-developed threat sharing software.
Versions and licences (28 October 2026)
OpenCTI’s latest GitHub release on the day of check is 7.261026.0 (opens in a new tab), published 26 October 2026. The repository LICENSE (opens in a new tab) states that Community Edition is under Apache License 2.0 and Enterprise Edition under the OpenCTI Enterprise Edition License; files without a licence header default to Community Edition. Filigran’s Enterprise Edition docs (opens in a new tab) repeat the open-core split and describe licence-key activation. Deployment docs recommend Docker or Kubernetes and document ElasticSearch/OpenSearch, Redis, RabbitMQ and object storage as dependencies.
MISP’s latest core release is v2.5.50 (opens in a new tab), published 10 October 2026 with notes dated 9 October 2026 (security hardening, Overmind UI, TAXII fixes and workflow updates). The MISP Project’s licence overview (opens in a new tab) lists core as AGPL-3.0-or-later; taxonomies, galaxies and warning-lists as CC0-1.0 or BSD-2-Clause; PyMISP as BSD-2-Clause. That AGPL posture matters if you modify the core and offer it as a network service — read the licence page; this is not legal advice.
Operationally, MISP is lighter than OpenCTI’s reference stack: the project’s download page (opens in a new tab) points teams at an Ubuntu 24.04 installer or Docker, on a conventional PHP and MySQL (or MariaDB) host with Redis — still real ops work, but fewer moving parts than a search cluster, queue and object store. Checked on 28 October 2026.
Head-to-head
| Dimension | OpenCTI | MISP |
|---|---|---|
| Primary role | STIX 2.1 TIP / knowledge graph | Threat sharing and correlation platform |
| Data model centre | STIX SDOs/SCOs and relationships | Events, attributes, objects, galaxies, taxonomies |
| Sharing model | Connectors, streams, RBAC (EE adds org segregation, SSO, audit) | Distribution levels, sharing groups, instance sync |
| Standards emphasis | Native STIX 2.1 | MISP format plus STIX 1/2 import-export |
| Integrations | Connector classes (import, enrichment, stream, file import/export); dedicated MISP connector documented | REST API, PyMISP, modules, ZMQ/Kafka streaming; IDS exports |
| Licence (community) | Apache-2.0 (CE); separate EE licence in-repo | AGPL-3.0-or-later (core) |
| Stable / current (checked 28 Oct 2026) | 7.261026.0 (26 Oct 2026) | 2.5.50 (9 Oct 2026 notes; GitHub 10 Oct) |
| GitHub stars (28 Oct 2026) | 10,213 (OpenCTI-Platform/opencti) | 6,626 (MISP/MISP) |
GitHub star counts are a crude activity signal, not a quality score.
OpenCTI: STIX graph, cases and connectors
If your mental model of CTI starts with “map the actor to the malware to the technique to the observable”, OpenCTI is the straight answer. Filigran’s FAQ states the platform is built on STIX 2.1 natively rather than mapped afterwards, with import and export as STIX 2.1 bundles. The documentation overview treats reports, cases and technical observations as first-class containers, then links them into the cold-knowledge encyclopaedia of threats and arsenal. That is a different rhythm from pasting hashes into an event form.
Connectors are the practical bloodstream. OpenCTI’s connectors documentation (opens in a new tab) classifies them as external import, internal enrichment, stream, import-file and export-file services with dedicated API credentials. The same page’s deployment example includes a full connector-misp service — OpenCTI can ingest MISP events as STIX rather than forcing a rip-and-replace. Connector catalogues live in Filigran’s XTM Hub; we did not count every entry, so marketing “400+” figures stay vendor claims only.
The Community versus Enterprise split is real and worth reading before you promise features to a CISO. Community Edition, per Filigran’s FAQ, includes the STIX knowledge graph, open-source connectors and community support. Enterprise Edition adds licensed capabilities such as assisted imports and summaries, playbooks and priority intelligence requirements, advanced RBAC, organisation segregation, SSO and audit trails, and vendor support with SLAs. Because EE code lives in the same public repository under a different licence header, “open source” here means open-core, not “every UI toggle is Apache-2.0”. Plan Community features first; treat EE as a purchase.
Operationally, OpenCTI is a platform with dependencies. The installation guide (opens in a new tab) centres Docker Compose or Kubernetes, with ElasticSearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage in the reference stack. That is more moving parts than a single appliance. Documentation reviews never prove upgrade pain on your cluster, and we will not pretend otherwise.
MISP: events, sharing groups and exports
MISP starts from a different question: how do trusted communities store, correlate and exchange structured threat data without turning every partnership into a PDF email chain. The features page leads with flexible modelling (atomic indicators through objects and Markdown reports), correlation including fuzzy hashes and CIDR overlaps, analyst collaboration via opinions, proposals and sightings, and vocabulary layers — taxonomies, warning lists and galaxies. Sharing is not an afterthought: distribution levels and sharing groups can apply down to individual attributes, with instance synchronisation and delegated publishing.
Automation is blunt and useful. The REST API, restSearch and PyMISP (opens in a new tab) path are first-class; enrichment runs through MISP modules; ZMQ or Kafka streaming pushes events, indicators and tagging changes. Export formats listed by the project include Suricata, Snort and Zeek outputs alongside STIX — which is why MISP still sits next to network sensors. Our Suricata vs Zeek head-to-head covers those engines; MISP is one common way teams feed them indicators.
The data model is event-centric rather than pure STIX-graph-centric. That is not a defect. Responders who think in “this intrusion, these attributes, this sharing group” often find MISP’s shape faster than STIX relationship gymnastics on day one. STIX interoperability via the misp-stix library means you are not locked out of STIX — you are choosing a different default grammar. AGPL on the core, and contributor-owned licensing language on the project site, are deliberate: the features page stresses the platform cannot become a closed proprietary product under that rule.
Together, not instead
The cleanest reading of both projects’ documentation is that they are complements more often than substitutes. Our free threat hunting toolkit for small teams already names MISP and OpenCTI together when indicator volume justifies the upkeep; this piece is the head-to-head on the platforms themselves. OpenCTI’s connectors documentation ships a MISP import example. MISP exports STIX and IDS formats that other tools consume. Choosing only one is fine for a narrow use case — MISP-only community sync, or an internal STIX graph — but published integration paths point at coexistence.
Licence posture differs for product and legal teams. OpenCTI Community Edition’s Apache-2.0 is generally permissive for redistribution; Enterprise features sit under a commercial Filigran licence. MISP core’s AGPL-3.0-or-later is copyleft with the Affero network clause. Read the project licence pages for your deployment model.
Where they sit in the stack
Neither tool is a SIEM, an EDR or a packet sensor. OpenCTI and MISP sit above detection and logging: they store, enrich, relate and distribute intelligence that sensors and SIEMs act on. In practice that consumer is often Elasticsearch or OpenSearch, a SIEM pipeline, Suricata or Zeek feeds, or a case system. We covered small-team SIEM options in a separate SIEM piece, and endpoint hunts in our Velociraptor DFIR review. This review stays on these two platforms.
Operational cost is mostly people, pipelines and disk, not the community licence. You still need someone who understands STIX or MISP taxonomies, a plan for feed quality, and an on-call path when a sync job fills the disk at 02:00. The free licence removes the purchase order; it does not remove the analyst rota.
What we could not verify
- Exact connector counts in Filigran’s XTM Hub library. Vendor marketing cites “400+”; we did not inventory the hub for this review.
- OpenCTI Enterprise Edition list prices or SaaS SKUs on the day of review.
- Hands-on ingest latency, false-correlation rates, UI workload or upgrade pain on any live deployment.
Who should pick which
Choose OpenCTI if you want a STIX 2.1-native TIP with investigation graphs, case objects and connectors aimed at feeding SecOps from a knowledge base. Start on Community Edition features you can enable without an Enterprise key, and budget platform complexity (search cluster, queue, object store) honestly.
Choose MISP if your priority is sharing and correlation with partners — distribution levels, sharing groups, instance sync — and exports that land in IDS, SIEM and analyst tooling with minimal drama. It remains the default language of many CERTs and ISACs for a reason.
Run both if you already belong to MISP communities and also want a STIX knowledge graph for internal analysis. That is what OpenCTI’s documented MISP connector implies, and what our hunting toolkit sketched for teams that have outgrown a shared spreadsheet.
Neither project replaces network sensors, endpoint telemetry or a human who can say “this campaign matters to us”. They are intelligence platforms with different personalities. Pick the one that matches the question you ask most often — who shares with whom, or how this actor connects to that malware — or keep both if staff time and infrastructure allow.
Follow Cyber-Threat.net RSSFeedly (opens in a new tab)X (opens in a new tab)Bluesky (opens in a new tab)LinkedIn (opens in a new tab)