EclecticIQ cost vs self-hosted OpenCTI and MISP

Where self-hosted OpenCTI and MISP cost less than EclecticIQ, and where they cost more

The open-source software carries no license fee, so the cost comparison with EclecticIQ turns on hosts, people and migration. OpenCTI Community Edition is licensed under Apache 2.0 and MISP under AGPL-3.0, so neither project charges to download or run the core platform. The line items that remain are the servers your deployment needs, the staff who operate them, and the one-time work of moving intelligence out of EclecticIQ. Your EclecticIQ subscription, support tier and any on-premises hosting terms must come from your own contract, so pull those figures before building the comparison.

Be careful about what counts as free in the OpenCTI case. The Enterprise Edition is a separate, proprietary license, and features such as audit logs, playbooks, organization-based segregation, AI insights and SSO for OpenID, LDAP, SAML and certificate or header authentication sit behind it, according to the OpenCTI Enterprise Edition documentation. If your EclecticIQ contract includes controls such as organization segregation or SSO that you rely on, price the Enterprise license against them. LTS releases also need a specific LTS license key, so confirm with Filigran whether an LTS line fits your upgrade cadence. MISP has no equivalent paid tier for the core platform, but you should still ask any commercial support provider what it charges.

Recurring costs will mostly be people and infrastructure. OpenCTI needs Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage, and its documented sizing calls for at least one platform node for every 3 workers, so connector volume drives the host count. MISP runs on a single-server or small cluster pattern, with the installer recommended on Ubuntu 24.04 for MISP 2.5. Budget for engineers who patch connectors, rotate keys and tune sync, and for analysts who curate feeds. Ask any implementation partner for a written scope that lists hosts, staff hours by role and the migration steps, so you can compare it fairly with your renewal.

Cost components on each side and whether they recur

This table lists each cost component of running EclecticIQ against self-hosted OpenCTI and MISP, who is paid for it, and whether it recurs. Read it as a checklist to fill in from your own vendor quote and internal estimates, since no prices are published here. The main takeaway is that the open-source side removes the license line but keeps hosting, staffing and connector upkeep as recurring costs.

Cost component	Who is paid	One-time or recurring
EclecticIQ subscription or license	EclecticIQ, or its reseller, under your contract	Recurring, usually annual or per term. Confirm scope, user counts and what the contract includes in writing.
EclecticIQ Foundation cloud package	EclecticIQ, for hosted service	Recurring. Ask what data residency, backups and support levels the package covers.
Production hosts on premises (RHEL or Rocky Linux)	Your hardware vendor, hosting provider or internal infrastructure team	One-time purchase or setup, plus recurring power, support and refresh. Ask EclecticIQ for its production sizing.
OpenCTI and MISP software	No license fee for Community Edition (Apache 2.0) or MISP (AGPL-3.0)	Zero license cost. Confirm whether you need OpenCTI Enterprise Edition features such as SSO or audit logs.
OpenCTI Enterprise Edition or LTS license keys	Filigran, only if you choose these options	Recurring if chosen. Absent from the cost base when you run Community Edition without LTS keys.
Storage and dependencies (Elasticsearch or OpenSearch, Redis, RabbitMQ, MinIO)	Your storage vendor or infrastructure team	One-time sizing, plus recurring capacity growth and backups. OpenCTI's documented sizing starts with 8 GB RAM for the search tier.
Implementation and migration	DeployOpen or your internal team, or a consultancy	One-time. Fixed-scope work is agreed in writing before it starts.
Connector and integration upkeep	Internal engineers or an implementation partner	Recurring. Each feed, enrichment and export connector needs monitoring and updates.
Analyst and engineer time	Your staff, who run queries, sharing groups and workflows	Recurring. Ask whether current EclecticIQ workflows have a direct equivalent in each platform.
Upgrades and support	Internal staff, a retainer partner, or community channels for MISP and OpenCTI	Recurring. OpenCTI LTS releases come on a 6-month cadence with one year of support each.

What moves the comparison most for your team

Five factors decide whether self-hosting OpenCTI or MISP costs more or less than staying on EclecticIQ. Each one changes host sizing, the number of people who keep the stack running, or both, so price the drivers in your own environment before comparing totals.

User count and concurrent analysts

The number of analysts who work in the platform at the same time drives how many platform nodes you need to keep the interface and GraphQL API responsive. OpenCTI's documented sizing starts the platform at 2 cores and at least 8 GB RAM, and it recommends at least one platform node for every 3 workers. Ask EclecticIQ for its user model and count your peak concurrent analysts, not total headcount, before you size hosts. Named users who rarely log in add license cost on the vendor side but little compute on yours.

Number of sources and connectors

Each intelligence feed, enrichment service and export runs as a connector, and OpenCTI workers consume RabbitMQ messages to write asynchronous updates. More sources mean more worker processes, more queue traffic and more connectors to patch and monitor when upstream APIs change. Inventory every EclecticIQ incoming feed, outgoing feed and integration, then decide which ones map to native OpenCTI connectors, which need custom development and which you retire. MISP covers many default feeds out of the box, which can lower the connector count for community sharing.

Data volume and index size

Stored observables, relationships and reports grow the Elasticsearch or OpenSearch index, which OpenCTI documents at 2 cores, 8 GB RAM and 16 GB SSD as a starting point. Storage needs also grow with MinIO or other S3-compatible object storage for uploaded files and exports. Measure current EclecticIQ entity counts, attachment volume and retention rules, then project growth over your retention period. Confirm with the OpenCTI and MISP teams how each platform handles deduplication and expiry, since this changes disk use more than raw feed volume.

Required availability and failover

Availability targets set the number of nodes for each tier: at least two search nodes, redundant Redis and RabbitMQ, and more than one platform node for failover. Each extra node adds hardware or virtual machine cost, patching time and monitoring scope on premises. If your EclecticIQ contract includes an uptime commitment or a disaster recovery site, write down the recovery time and recovery point you need, then ask whether a single-host MISP instance with tested backups meets them. Do not assume an open-source default meets your targets without testing failover.

Edition choice and support model

OpenCTI Community Edition is licensed under Apache 2.0, while Enterprise Edition adds audit logs, playbooks, organization-based segregation, full text indexing, AI insights and SSO options under a separate license. OpenCTI LTS releases require a specific LTS license key, and the LTS line receives only critical bug and security fixes after stabilization. MISP is AGPL-3.0 with no paid tier, so its cost sits in your staff time and any support contract you choose. Price the Enterprise license only if your required features are on the Enterprise list, and ask for the license terms in writing.

Staff skills and on-call coverage

The largest recurring cost is usually the people who run the stack: Elasticsearch tuning, RabbitMQ queues, Redis memory, connector upgrades and MISP PHP and MySQL or MariaDB maintenance. OpenCTI releases arrive on a date-based cadence, and LTS lines are supported for one year, so someone must plan upgrades twice a year at minimum. Check whether your team already runs Linux, containers and a search cluster, and whether you have an analyst who can write or maintain PyMISP or connector code. Budget for a skills gap in a fixed-scope implementation plus a retainer for upgrades if in-house coverage is thin.

How on-premises hosting adds to the OpenCTI and MISP bill

Production OpenCTI is a set of cooperating services, so the hosting bill follows the component count more than the application count. The platform serves the web interface and GraphQL API, Python workers consume RabbitMQ messages for asynchronous writes, and connectors handle import, enrichment, file extraction, export and stream consumption. The dependencies are Elasticsearch 8.0 or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later, and S3-compatible storage such as MinIO. The OpenCTI deployment overview documents starting sizes of 2 cores and at least 8 GB RAM for the platform, and 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, with at least one platform node for every 3 workers. Each dependency needs its own patching, backup and failover plan, and each non-production environment multiplies that work. Ask your architect to turn the worker and connector plan into a node list for production, staging and disaster recovery.

MISP has a smaller footprint but its own stack. It runs on PHP with CakePHP, a relational database and Redis. MISP 2.5.47 introduced PostgreSQL support through a new database migration system, so the database engine is now a decision rather than a fixed requirement, and you should confirm which engine your DBA will support before the build starts. The MISP download page recommends Ubuntu 24.04 with the provided installer for MISP 2.5, and lists Docker images, RPM packages and an Ansible role as alternatives. Because your EclecticIQ estate runs on RHEL or Rocky Linux, you must decide whether MISP joins that fleet through RPM packages and your own hardening baseline, or gets a separate Ubuntu host class with its own patch cycle. Either choice adds an operating system to manage. Confirm the MISP host count with the instance and database layout you intend to run.

How to build the comparison with your own numbers

This sequence turns your current EclecticIQ spend and your planned self-hosted OpenCTI or MISP stack into one side-by-side model, where every line traces to a contract, invoice or written quote.

Inventory your EclecticIQ subscription terms
Pull the signed order form, the subscription schedule and the support terms from your contracts team, then record the licensed product, the user or seat counts, the renewal date, the notice period and any clauses on overage, data export or support tiers. Confirm with EclecticIQ whether your production configuration is licensed as on-premises software or as the Foundation cloud package, because that decides which cost lines apply. Done when every recurring EclecticIQ line has a source document and a renewal date attached to it.
List hosts, storage and network in use
Work with your platform and infrastructure teams to list every server, virtual machine and storage volume that EclecticIQ uses today, including application, database, search, backup, staging and disaster recovery nodes. Record the operating system (RHEL or Rocky Linux for on-premises deployments), CPU, memory, disk, backup retention and the internal and external network paths. Use your hypervisor, cloud billing or asset records rather than estimates. Done when each host has a row with its cost source, such as an internal chargeback rate, a cloud invoice line or a hardware depreciation schedule.
Cost the OpenCTI or MISP component stack
Map the self-hosted target to its components. For OpenCTI, list the platform nodes, Python workers, connector hosts, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage such as MinIO. For MISP, list the application server, the MySQL or MariaDB or PostgreSQL database, Redis, and the sync and backup hosts. Check the sizing guidance in the OpenCTI deployment overview and the MISP download page, then price each host using the same rates as step two. Note that OpenCTI Enterprise Edition is a separate proprietary license and that LTS releases require a specific license key, so ask Filigran for those terms in writing. Done when each component has a host count, a size and a cost basis.
Price implementation and migration as written quotes
Send the scope for the target platform to two or three implementation partners and to your internal team's estimate, covering architecture, installation, SSO, hardening, backup, the data export and import from EclecticIQ, and parallel running. Ask each provider to state fixed deliverables, assumptions, exclusions and payment milestones in writing. DeployOpen works on fixed scopes agreed in writing before work starts, and a quote follows from that scope. Done when every migration line item is a signed or written quote you can compare line by line.
Estimate analyst and engineer hours
Ask your SOC and threat intelligence leads to log the hours their analysts spend on feeds, connectors, enrichment, sharing requests and upgrades for one representative period, using your ticketing or time records. Ask platform engineers to estimate the hours for connector maintenance, OpenCTI or MISP upgrades, patching, certificate and backup checks, and on-call coverage. Separate the work that exists today from the work the new platform would add or remove, and record who would do it. Done when each role has a monthly or per-cycle hours figure traced to a record, and the assumptions are written down.
Model one-time and recurring totals
Build a spreadsheet with two columns, EclecticIQ and the target stack, and separate one-time costs (implementation, migration, parallel running, hardware purchase, training) from recurring costs (licenses, support, hosting, storage growth, staff time, retainers). Apply the same term length to both sides and show totals for the full planned term. Add a sensitivity row for the cost drivers that move most, such as seat count, host size and the hours estimate. Done when each figure cites its source and the model reconciles to the current EclecticIQ invoices within a range you can explain.
Ask every vendor to confirm the inputs
Send the completed model to EclecticIQ, Filigran for OpenCTI Enterprise terms, and your implementation providers, asking each to confirm or correct the lines that concern them in writing. Record any term that changes the result, such as minimum seat counts, support tiers, license-key rules for LTS releases or data export limits. Re-run the model with the confirmed values and keep the version history. Done when every input has a written confirmation or a documented open question with an owner.

Questions buyers ask before comparing EclecticIQ with self-hosting

How much effort does self-hosting OpenCTI or MISP take?

Effort depends mainly on the platform you choose and how many services you run. OpenCTI is a multi-service stack: the platform, Python workers, RabbitMQ, Redis, an Elasticsearch or OpenSearch cluster and S3-compatible storage such as MinIO, plus connectors. MISP is a PHP application with MySQL or MariaDB and Redis, installed on Ubuntu 24.04 with the provided installer, or deployed through Docker images, RPM packages, an Ansible role or a Puppet module. OpenCTI's documented sizing starts at 2 cores and 8 GB RAM for the platform, and at 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch. Ask for a written sizing of your data volume, connector count and analyst count before comparing hosts with your current EclecticIQ footprint.

Can our team run OpenCTI or MISP without outside help?

Teams with Linux, database and container experience can run MISP or OpenCTI in-house, but the work is continuous rather than a one-time install. Plan for named owners of the platform, the data stores, the connectors and the upgrade calendar. Many organizations keep day-to-day operations internally and bring in an implementation partner for architecture, hardening, integration and documentation. DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted platforms in your environment, under a fixed-scope written agreement, with ongoing support available as a retainer. Confirm your team's skills against the list of components before deciding.

How long does a migration from EclecticIQ take?

No duration can be stated here without your data inventory, so treat any figure you see elsewhere as unverified. The main drivers are the volume of entities and relationships, the number of incoming and outgoing feeds to rebuild as connectors or sharing groups, the amount of custom object and taxonomy mapping, and how many downstream tools must be repointed. Running both platforms in parallel until consumers switch over adds time but reduces cutover risk. Ask any vendor or partner for a milestone plan that lists export validation, import, count checks, feed rebuilds and a parallel-run period.

How do OpenCTI release cycles affect upkeep?

OpenCTI ships regular releases with date-based version numbers, from daily to weekly when ready, and LTS releases every 6 months, each supported for 1 year, which gives a 6-month overlap between consecutive LTS versions. Teams that run regular releases must test and upgrade frequently. Teams on LTS receive only critical bug and security fixes after a one-month stabilization period, and LTS releases require a specific LTS license key. Budget for a standing upgrade cycle, staging tests and connector compatibility checks, and confirm with Filigran which license terms apply to your edition.

How do MISP 2.5 upgrades differ from MISP 2.4 end of life?

MISP 2.4 is end of life and receives only security fixes, and the project strongly advises against installing new 2.4 instances. MISP 2.5 is the recommended version for new deployments and includes a new database migration system with PostgreSQL support in MISP 2.5.47. If you run 2.4 today, plan an upgrade rather than a patch-only approach, and use the upgrade script the project provides for Ubuntu. Test plugins, sync partners and custom integrations against 2.5 in staging, because version changes can affect them.

What should a self-hosting quote include?

A usable quote lists each cost component and who is paid for it. Ask for these items separately:

Scope, deliverables and timeline agreed in writing before work starts
Infrastructure: hosts or cloud resources for the platform, data stores, workers and connectors, in each environment
Migration work: export validation, import, feed rebuilds and parallel running
Hardening, backup and restore testing, and documentation
Upgrade and support arrangements, one-time versus recurring
Your internal staffing for connector upkeep and analyst work

Request the EclecticIQ subscription and hosting figures from your own contract as the baseline.

Where do the ongoing costs of self-hosting come from?

Ongoing costs come from hosting, staff time and licensing. Hosting covers compute, storage, backups and network for each environment, and grows with indexed data volume and connector count. Staff time covers platform administration, connector maintenance, upgrades and analyst training. Licensing depends on the edition: OpenCTI Community Edition is Apache 2.0, while Enterprise Edition features such as audit logs, playbooks, organization-based segregation and SSO are under a separate proprietary license. MISP is AGPL-3.0 licensed, and its taxonomies and galaxies carry their own CC0 or BSD terms. Ask which features your EclecticIQ setup depends on so you can check their edition requirements.

Costs teams forget on each side

Licence and subscription lines are easy to compare, so the costs that get missed tend to sit in exports, renewals, connector upkeep and evidence work. The cards below cover what each side of the comparison carries after the first deployment, and what to ask for before any figures are signed off.

Export effort and renewal terms

Before comparing totals, confirm what EclecticIQ charges or restricts for bulk extraction, how many outgoing feeds and API calls your current contract allows, and how notice periods and auto-renewal clauses work. Exporting intelligence, relationships and custom objects takes analyst and engineer time, and that time recurs if you must re-export during a parallel run. Ask the vendor in writing what is included in the renewal and what the exit process costs.

Connector maintenance on OpenCTI

Each OpenCTI connector for MISP, TheHive, MITRE ATT&CK or your commercial feeds is software you run, patch and monitor. Connector failures often surface as stale data rather than errors, so someone must watch queues and worker health. Budget engineer time for upgrades that accompany each platform release, and check which of your current EclecticIQ feeds have no maintained connector.

LTS license handling for OpenCTI

OpenCTI LTS releases are distributed as container images but require a specific LTS license key to use. Track which LTS line your deployment uses, when its one-year support window ends, and who in your organization holds the key and renewal relationship with Filigran. Upgrades that move between LTS lines need planning and testing time, and missing a window can leave you on a line that receives only critical and security fixes.

Sharing agreement administration on MISP

MISP sharing depends on distribution levels, sharing groups, synchronization settings and the trust agreements behind each community feed. Someone must review partner connections, revoke access when a partner leaves, and keep the organization's sharing policy aligned with what the platform enforces. This work is administrative rather than technical, and it grows with each new community or partner you add.

Backup and disaster recovery

Self-hosting moves backup responsibility to your team. OpenCTI spans the platform, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage, so a restore must bring these back consistently. MISP stores its data in MySQL or MariaDB, or PostgreSQL in newer releases, plus attachments and configuration. Define recovery objectives in writing, test restores on a schedule, and confirm that EclecticIQ exit exports are not your only copy of historical data.

Security hardening and audit evidence

A self-hosted threat intelligence platform holds sensitive indicators and partner data, so you own patching, access reviews, authentication configuration and logging. Enterprise features such as audit logs and SSO options in OpenCTI, and the authentication plugins available for MISP, need configuration and evidence collection. DeployOpen prepares these controls and evidence for assessment, but independent auditors issue any audit report, so ask your assessor which artifacts they will expect.

Which cost profile fits OpenCTI, MISP or both

Teams whose main job is distributing indicators to partners, ISACs or trusted communities usually start with MISP. The largest cost sits in the sharing model rather than in the analytics stack: someone must define distribution levels, sharing groups, synchronization partners and the trust relationships behind them. MISP is open source under AGPL-3.0, so the software itself carries no license fee, and the recurring spend moves to the host, the database and the people who run synchronization.

Host and database: MISP is recommended on Ubuntu 24.04 with the provided installer, and a PostgreSQL option now exists alongside MySQL or MariaDB, so the team should decide early which database it will back up and patch.
Sync and sharing administration: Partner onboarding, sharing group changes and failed synchronization need a named owner who answers within a defined window.
Feeds and taxonomies: Default feeds, warning lists and galaxies need regular review so false positives do not spread through the community.
Skills: Expect a PHP and Linux administrator, plus someone who understands the STIX and sharing conventions your partners expect.

Ask any integrator to price the sharing governance, not only the installation, because that work recurs for as long as the community grows.

What migration adds to the one-time budget

Migration is the largest one-time line in this comparison, and it is the one most often underestimated. The work splits into four pieces: exporting intelligence from EclecticIQ, importing it into OpenCTI or MISP, rebuilding the feeds and sharing relationships that move data in and out, and running both platforms side by side until downstream consumers are repointed. Export typically runs through outgoing feeds, the REST API or STIX export, and the first task is to confirm which of these carries entities, relationships, custom objects and taxonomy tags without loss. Ask the migration partner to document that mapping before any import starts, and to reconcile record counts between source and target at each stage.

Rebuilding is where most of the effort sits. In OpenCTI, incoming feeds generally become connectors, which means each one needs its own configuration, credentials, scheduling and monitoring on your hosts. In MISP, feeds and sharing relationships are rebuilt around events, distribution levels and sharing groups, and every partner community must be re-approved on the new instance. Custom EclecticIQ objects have no one-to-one counterpart in either platform, so each one needs a mapping decision, a documented loss, or a custom extension. Confirm with the vendor and with your own analysts which of these objects are in active use, because unused objects are cheap to drop and used ones are expensive to model.

Price the migration as a fixed scope. Agree in writing the sources, the feeds and connectors to rebuild, the custom objects to map, the number of validation rounds, the parallel run period and the cutover criteria before work starts, and ask for the cost of each item separately. Expect the parallel run and the connector rebuild to be the main drivers of duration. Dedicated detail on each path appears in the migration guides: How to export your data from EclecticIQ covers extraction, while the OpenCTI and MISP migration pages cover import and rebuild steps. Treat the one-time migration budget as separate from the recurring run costs above, and do not sign until the cutover exit criteria are on paper.

How DeployOpen scopes a fixed-price self-hosted implementation

DeployOpen plans, implements, hardens, documents and supports self-hosted open-source platforms inside your own infrastructure. For a cost comparison between EclecticIQ and self-hosted OpenCTI or MISP, we start with a written scope that names every component, host and connector in your environment.

How we scope

Inventory current EclecticIQ subscriptions, hosts, feeds and integrations so the cost baseline reflects your actual estate.
Agree in writing which platform, OpenCTI, MISP or both, fits your sharing and analyst workflows before any build work starts.
Define the written scope, deliverables and timeline together, since most engagements are fixed-scope and quoted from that document.

How we build

Size the OpenCTI dependencies (Elasticsearch or OpenSearch, Redis, RabbitMQ, S3-compatible storage) or the MISP host against your expected data volumes.
Configure authentication, such as SSO for OpenID, LDAP or SAML where your edition supports it, and document sharing groups and distribution levels.
Build and test connectors and feeds in a non-production environment, then compare record counts and relationships with the EclecticIQ source.

How we hand over

Deliver architecture, runbooks and backup and upgrade procedures so your staff can operate the platform without DeployOpen on call.
Provide evidence and control documentation for your compliance team, noting that independent auditors and certification bodies issue any formal assessment.
Walk your analysts and engineers through connector monitoring, release cadence and the LTS or 2.5 upgrade path you select.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer, scoped separately from the initial implementation.
Confirm with your team which platform releases you will track, since OpenCTI and MISP publish releases on different cycles.
Ask any quote to separate one-time migration effort from recurring hosting, licensing, staffing and retainer costs.