EclecticIQ Intelligence Center, a threat intelligence platform deployed on premises on RHEL or Rocky Linux or as a cloud service. Pages here cover replacing it with self-hosted OpenCTI or MISP.
Comparing EclecticIQ Intelligence Center with self-hosted OpenCTI, both built around STIX 2.1: data model and custom objects, connectors and enrichment, dissemination through outgoing feeds against TAXII collections and streams, cluster sizing, and the open-source and paid editions behind each.
EclecticIQ against MISP for teams whose main job is exchanging indicators with partners and communities: sharing models, feeds and export formats, analyst workflows, the infrastructure each needs, and when MISP alone is enough versus pairing it with OpenCTI.
Moving from EclecticIQ to OpenCTI: exporting entities as STIX through outgoing feeds or the REST API, importing into OpenCTI, re-creating incoming feeds as connectors, mapping custom objects and taxonomies, and running both until downstream tools are repointed.
Moving EclecticIQ intelligence and sharing relationships to MISP: exporting indicators as STIX or CSV, importing them as MISP events, rebuilding feeds and sharing groups, and handling EclecticIQ data that has no direct MISP equivalent.
Cost of ownership by component: EclecticIQ subscriptions or the Foundation cloud package, plus the hosts its production configurations need on premises, against OpenCTI and MISP on your own servers, migration, and the analysts and engineers who keep connectors running.
Getting intelligence out of EclecticIQ before a contract ends: outgoing feeds in STIX, CSV or other formats, the REST API for bulk extraction, what exports carry over such as relationships and custom objects, and checking counts against the source.
Tell us what you're working on, whether it's a deployment, an audit, a security test or a cyber range. You'll speak with an engineer who can help you scope it.