Threat Intelligence Tools
Threat intelligence platforms and software collect, correlate, and distribute indicators of compromise and adversary tradecraft data. This category covers open-source TIPs, IOC sharing communities, and STIX/TAXII tooling that feed detection and response workflows.
Software in Threat Intelligence Tools
9 toolsNo tools in this category match the selected filters.
| Tool | License | Platforms | Pricing |
|---|---|---|---|
| Abuse.ch Threat Feeds Community threat intel family: URLhaus, MalwareBazaar, ThreatFox, and YARAify, in partnership with Spamhaus. | Proprietary | Web | Freemium |
| AlienVault OTX Open threat exchange community where researchers share and investigate threat data through Pulses (IOC bundles), a searchable portal, and a free STIX/TAXII API. | Proprietary (service); Apache-2.0 (Python SDK) | Web, Linux, macOS, Windows | Free |
| Hunt.io Platform for hunting adversary infrastructure, from active C2 servers to phishing kits and open directories. | Proprietary | Web | Commercial |
| IntelOwl Open-source threat intelligence orchestration platform that enriches files and observables through a single REST API against multiple analyzers and external services. | AGPL-3.0-only | Linux | Open Source |
| MISP Threat intelligence platform for sharing, storing, and correlating indicators of compromise across security teams and SOCs. | AGPL-3.0-or-later | Linux | Open Source |
| OpenCTI Threat intelligence platform for organizing, storing, and visualizing STIX-based knowledge, observables, and threat actors. | Apache-2.0 (Community Edition) + OpenCTI Enterprise Edition License (proprietary) | Linux | Free / Commercial |
| Recorded Future AI-driven threat intelligence platform with sandboxing, now a Mastercard subsidiary. | Proprietary | Web | Commercial |
| Vertex Synapse Analytic platform for object-driven threat analysis with an open source core and enterprise edition. | Apache-2.0 | Linux, Web | Free / Commercial |
| Yeti Open-source threat intelligence and forensics platform for storage, correlation, and export of IOCs, TTPs, and DFIR artifacts. | Apache-2.0 | Linux | Open Source |
About Threat Intelligence Tools
Threat intelligence platforms collect, correlate, and distribute indicators of compromise and adversary tradecraft data. The category covers threat intelligence platforms (TIPs) that store and manage IOC data, IOC sharing communities where organizations exchange threat indicators, and orchestration tools that automate enrichment of observables against multiple data sources. OpenCTI is a graph-based TIP that models threats using a STIX2-based schema and provides a web interface for analysts to explore relationships between indicators, threat actors, and campaigns. MISP is a community-driven sharing platform where organizations exchange IOCs through trusted circles, with support for STIX, OpenIOC, and custom export formats. IntelOwl orchestrates enrichment by sending a single API request to many analyzers and external services, automating the manual work of looking up IPs, domains, and file hashes across multiple sources. AlienVault OTX provides a free community feed of threat indicators contributed by its participants, accessible via REST API and TAXII. The category feeds detection engineering and DFIR workflows, since IOCs from threat intelligence platforms populate blocklists, detection rules, and SIEM correlation queries. Tools in this category range from open source community platforms to commercial threat intelligence services.
Covered Topics
In This Catalog
- This category lists 9 tools: 3 open source, 2 commercial, 2 free / commercial, 1 free, and 1 freemium.
- By platform, 6 run on Linux, 1 on Windows, 1 on macOS, and 5 on the web.
Frequently Asked Questions
What is Threat Intelligence Tools?→
Threat intelligence platforms and software collect, correlate, and distribute indicators of compromise and adversary tradecraft data. This category covers open-source TIPs, IOC sharing communities, and STIX/TAXII tooling that feed detection and response workflows.
What topics does the Threat Intelligence Tools category cover?→
Threat Intelligence Platforms (TIP), IOC Sharing Communities, STIX / TAXII Protocol Tooling, Observable Enrichment Automation, Adversary Threat Feeds
Which Threat Intelligence tools are open source?→
3 of the 9 tools in this category are open source: IntelOwl, MISP, and Yeti.