OpenCTI Community vs Enterprise Edition

No price is published for OpenCTI Enterprise Edition, and the cost follows from the agreement you sign with Filigran. The OpenCTI Enterprise Edition docs state that on-premises use of EE is reserved to organizations that have signed a Filigran Enterprise agreement, so that agreement is the document that sets the license terms. Ask Filigran for the license scope, the term, whether the fee recurs, and which support and upgrade rights are included. Trial licenses can be generated from Filigran's website, which lets your team test EE features before the commercial conversation. Confirm with Filigran whether your use case, such as a charity, research or connector development, qualifies for a free EE license under its published criteria.

Three costs recur whichever edition you run: the license subscription if you use Enterprise, the infrastructure that runs the platform and its dependencies, and staff time for upgrades and maintenance. The Community Edition removes the license fee but not the operating work. OpenCTI releases arrive on a regular cadence, with non-LTS builds shipping from daily to weekly and LTS builds every 6 months, each supported for 1 year according to the OpenCTI product life cycle docs. Each upgrade needs testing against your connectors and dependencies. Budget for those cycles explicitly, whether the work is done by your own staff or by a partner under a retainer.

The Community Edition is free to license, but it still needs several supporting services in your environment. According to the OpenCTI deployment overview, you must run Elasticsearch 8.0 or later or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO. The same overview documents sizing: the platform needs 2 cores and at least 8 GB RAM, Elasticsearch or OpenSearch needs 2 cores, 8 GB RAM and 16 GB SSD, and at least one platform node is recommended for every 3 workers. Each of these components has its own patching, backup and capacity work, which is the largest recurring cost of the free edition.

Your organization pays for the infrastructure in every case, because OpenCTI is self-hosted in your own cloud accounts, data centers or air-gapped networks. The compute, storage and network charges for the platform, workers, connectors and dependencies land on your infrastructure budget. Sizing decides the bill: the documented minimums are a starting point, while production load from many connectors, large indicator volumes and full-text indexing will push memory and storage higher. Ask your architects to model the expected connector count, data volume and retention before comparing editions, since Enterprise features such as full-text indexing add to that load.

Staff time depends on how many components you operate, how often you upgrade and whether you need Enterprise controls such as SSO and audit logs. The Community Edition still requires someone to run the platform, Python workers, connectors and the search, cache, queue and object storage services. Enterprise adds configuration work for SSO through OpenID, LDAP or SAML and for organization segregation and playbooks. Ask any implementation partner for a written scope that lists the components, environments, connectors and integrations included, along with the upgrade and backup responsibilities after handover. Those written items, not a generic estimate, are what make effort comparable between options.

Yes, the support model affects both the license and the upgrade workload. According to the OpenCTI product life cycle docs, LTS releases are distributed as container images but require a specific LTS license key to use, and after a one-month stabilization they receive only critical bug and security fixes. Teams that want fewer disruptive upgrades can plan around LTS branches, while teams that want the newest features will upgrade more often. Confirm with Filigran whether your agreement includes LTS keys and how long each LTS line is covered, and factor the upgrade cadence into your staffing plan.

Ask for a written quote that separates the Filigran license from the implementation work, because they are paid to different parties. Request the edition and license scope from Filigran, including the agreement term and whether fees recur. For any implementation partner, request a fixed scope listing the environments, dependencies (OpenSearch or Elasticsearch, Redis, RabbitMQ, S3 storage), connectors, SSO configuration, backup and hardening work, upgrade support and handover documents, along with deliverables and timelines agreed in writing before work starts. Ask how ongoing support and upgrades are billed, and whether they are included or offered as a retainer.

Yes, the Community Edition runs under the Apache License 2.0 without an EE license, but you should confirm the features you need before committing. According to the OpenCTI Enterprise Edition docs, audit logs, playbooks and automation, organization segregation, and SSO through OpenID, LDAP, SAML, certificate or header authentication are EE features. If your security or compliance requirements depend on those controls, the Community Edition may not meet them without compensating work. Your team can run the Community Edition in-house if it has the staff for the dependency stack and upgrades, or bring in a partner under a fixed scope for planning, deployment and handover.

Yes, the Community Edition is licensed under Apache-2.0, so your team can deploy and run it without an outside partner. The harder part is the platform around it: OpenCTI depends on Elasticsearch 8.0 or later or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO, and it runs Python workers and connectors. Your team needs to size and operate those services, set up backups and keep connectors current. If you lack staff who run these components, a fixed-scope engagement can cover the build and handover, and a retainer can cover upgrades. Confirm your in-house skills against the OpenCTI deployment overview before you decide.

On Community Edition, SSO is not available as a supported option, so the effort is not a configuration task at all. SSO through OpenID, LDAP, SAML, certificate or header authentication is an Enterprise Edition feature, and the authentication documentation states that these strategies have required Enterprise Edition since OpenCTI 7.260224.0. On Enterprise Edition, the effort depends on your identity provider, the attribute mapping you need, and how you handle group-based access. Plan for an identity team to supply metadata, test accounts and a rollback path. Check the current OpenCTI authentication docs for the exact steps for your protocol.

Activation itself is short: you generate a trial license from Filigran's website, enter it in the platform settings and accept the EULA. No duration is supplied for the trial window or the time Filigran takes to issue a key, so ask Filigran directly before planning a proof of concept. The longer work comes after activation, when you decide which EE features (audit logs, playbooks, organization segregation, SSO) your pilot needs and test them against your data. Scope that testing in writing so the trial produces evidence you can use in a purchase decision.

Expect to provide a named technical owner, access to the cloud accounts, data centers or air-gapped network where OpenCTI will run, and people who understand your threat intelligence workflows. Your identity team is needed for SSO, and your security or compliance lead should agree which audit logs and evidence you require. Your platform team must own the dependency services, backups and monitoring after handover. Ask any implementation partner to list these inputs in the written scope so you can confirm what your staff must commit to before work starts.

Filigran's documentation describes Enterprise Edition as a license activated in the same platform settings, which suggests the EE features are enabled on your existing instance rather than requiring a separate product. Confirm this in writing with Filigran before you rely on it, including how the upgrade treats your existing data, connectors and configuration. Take a full backup of your data stores and test the activation on a non-production copy first. Remember that EE on premises requires a Filigran Enterprise agreement, so the upgrade depends on that commercial step as well as the technical one.

Filigran may provide free EE licenses for development and research, such as connector development and technical partner integrations, and for non-governmental charities. Commercial organizations and government bodies should assume a paid agreement is required for on-premises use, since on-premises EE is reserved to organizations that have signed a Filigran Enterprise agreement. Filigran is the only company that produces EE license keys, so any consultant who offers one should be asked to show the source. Contact Filigran to confirm whether your use case fits a free category before you request a license.

The Enterprise Edition docs list activity monitoring (audit logs), organizations management and segregation, authorized members, draft mode capability control and SSO as EE features. These are the controls most often requested when showing who accessed or changed intelligence data. Map each control your auditor or regulator expects to a specific EE feature, then verify it in a test environment. DeployOpen prepares systems, controls and evidence for compliance assessments, but independent auditors issue any audit report or certification. Confirm the auditor's expectations before you buy a license.

Regular releases use the x.YYMMDD.z pattern, and LTS releases use x.YYMMDD.z-lts.n. Non-LTS releases ship from daily to weekly, while LTS releases appear about every 6 months and are supported for 1 year, which gives a 6-month overlap between consecutive LTS versions. LTS builds are distributed as container images but require a specific LTS license key, and after a one-month stabilization they receive only critical bug and security fixes. Choose a release track deliberately, because a regular release may need more frequent upgrades than an LTS line.