When OpenCTI SaaS or self-hosting fits your team
For a CTI or security team deciding where OpenCTI runs, the choice turns on three questions: where your data is allowed to live, how much platform capacity your team can staff, and whether you need Enterprise Edition features such as SSO, audit logs, playbooks and organization segregation. Choose Filigran's SaaS when data residency rules permit a vendor-hosted tenant and you would rather not operate Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage yourself. SaaS runs the Enterprise Edition, and the Medium and Large dedicated sizes both include unlimited users, connectors and integrations, so you should confirm with Filigran which tier fits your sizing and where the tenant is hosted.
Choose self-hosted Community Edition when data must stay inside your own cloud accounts, data centers or air-gapped network, you have engineers to run the stack, and you can do without the paid capabilities. The Apache-2.0 Community Edition can be self-hosted without a Filigran agreement. Confirm that the connectors, workflows and access controls you need work without EE, because the platform's audit logs, playbooks and SSO are gated.
Choose self-hosted Enterprise Edition when you need the EE features on your own infrastructure and must keep data on premises. This route requires a signed Filigran Enterprise agreement before you run EE, so ask Filigran for the agreement terms, license scope and renewal conditions early in procurement. You will carry the operating work of the full dependency set, and the cost of that staffing should be compared against SaaS on the same written scope.
How the two models compare on the factors that decide the choice
This table sets Filigran's managed OpenCTI SaaS against running OpenCTI on your own infrastructure, row by row on the factors that usually settle the decision. Read each row as a question to answer with Filigran and your own compliance team, since several cells depend on terms that must be confirmed in writing.
| Factor | Filigran OpenCTI SaaS | Self-hosted OpenCTI |
|---|---|---|
| Edition running | Enterprise Edition, per Filigran's SaaS tiers; EE licenses are provided automatically to SaaS customers | Community Edition (Apache-2.0) needs no Filigran agreement; EE requires a signed Filigran Enterprise agreement |
| Sizing options | Two dedicated sizes: Medium (8 vCPU, 32 GB memory, 256 GB storage) and Large (16 vCPU, 64 GB memory, 512 GB storage) | You size the platform, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3 storage yourself against OpenCTI's documented minimums and worker ratios |
| Pricing basis | Resource-based only, never per user or per integration; no prices published, so a quote follows from the chosen size | Software cost is nil for Community Edition; infrastructure, staff time and any EE agreement are your costs |
| Tenant segregation | Each instance runs in its own infrastructure tenant, per Filigran's SaaS page | Segregation is set by your own network, cloud account and hosting design |
| Support inclusion | Standard support package included with cloud hosting plans, including two health checks per year and one annual workshop | Support depends on your EE agreement or your own staff; confirm what any agreement covers |
| SSO and audit logs | Available on EE tiers; confirm which SSO protocols Filigran enables on your instance | Audit logs, playbooks and SSO through OpenID, LDAP or SAML need an EE license; confirm activation steps with Filigran |
| Agreement needed | Filigran SaaS subscription with its terms; confirm data residency and contract terms in writing | Signed Filigran Enterprise agreement for EE; none for Community Edition |
| Operations and patching | Hardened, monitored and updated by Filigran; confirm the change and maintenance windows in the contract | You run upgrades, backups and monitoring; LTS releases need a specific LTS license key |
What data location and compliance mean in each model
Data location, access and patching responsibility change with the deployment model, and so does the evidence you can show an auditor. The cards below separate what Filigran's SaaS badges cover from what your own controls must still prove.
Where the data lives
In Filigran's SaaS, each customer instance runs in its own infrastructure tenant, so your intelligence sits in a Filigran-operated environment rather than your data center. In a self-hosted deployment, the platform, its Elasticsearch or OpenSearch index, Redis, RabbitMQ and S3-compatible storage all sit where you put them. Ask Filigran which regions and facilities host your tenant and where backups are kept.
Who holds access
SaaS moves administrative access to the platform layer to Filigran, while your analysts and administrators still manage users, groups and connectors inside OpenCTI. Self-hosting keeps host, database and storage access inside your own identity and privileged access controls. Document which accounts can reach the underlying hosts, who approves that access, and how it is logged.
Who patches and hardens
Filigran states that SaaS instances are hardened, monitored and updated by Filigran. Self-hosted, your team or your implementation partner owns OS patching, dependency upgrades, OpenCTI release upgrades and hardening baselines. Confirm in writing the upgrade window, how security fixes reach your instance, and whose change records cover them.
What SOC 2 Type 2 and ISO 27001:2022 badges show
The SOC 2 Type 2, ISO 27001:2022 and GDPR badges on Filigran's SaaS page signal that the vendor has been assessed or states compliance with those frameworks. They do not, by themselves, cover your data classification, your retention choices or your own configuration of users and connectors. Request the current report or certificate scope from Filigran through its trust page and check whether it covers the SaaS service you will buy.
What the GDPR badge does not settle
A GDPR badge on a vendor page does not decide whether your processing is lawful, which legal basis applies or whether a transfer mechanism is in place. Those decisions stay with your data protection team and, for threat intelligence that includes personal data, your records of processing. Ask Filigran for its data processing terms, subprocessor list and data location commitments before you upload anything.
Evidence DeployOpen prepares, not attestations
DeployOpen plans, hardens and documents self-hosted platforms and prepares the systems, controls and evidence an assessment will examine. DeployOpen does not issue audit reports, attestations or certifications. Independent auditors and certification bodies decide compliance outcomes for your organization, whichever deployment model you choose.
Which features each model gives you access to
Filigran's SaaS tiers run the Enterprise Edition, and the OpenCTI Enterprise Edition documentation states that EE licenses are provided automatically to all Filigran SaaS customers. In practice, a SaaS buyer does not negotiate an EE agreement or manage a license key for the platform. Capabilities that the OpenCTI documentation places behind EE, including SSO configuration through OpenID, LDAP or SAML, audit logs, playbooks and automation, and organization segregation, are therefore part of the SaaS offer. The self-hosted Apache-2.0 Community Edition does not include these, so a team that needs them on its own infrastructure must take the Enterprise path.
Self-hosting EE requires a signed Filigran Enterprise agreement, while the Community Edition can be run without one. Before you commit, ask Filigran for the current EE feature list, the license terms for your deployment model, and whether any feature you depend on (for example, a specific authentication method or an automation capability) is included in your agreement. Feature lists change between releases, so confirm them against the version you plan to run, such as the current release on the OpenCTI releases page, rather than relying on this page.
If your SSO or audit requirements are firm, price the self-hosted EE path with the same care as the SaaS quote. Ask Filigran to state in writing which EE capabilities are covered by the self-hosted agreement and which are operated by Filigran only in SaaS. Also confirm how LTS license keys apply to your instance, since the OpenCTI life cycle documentation says LTS releases require a specific LTS license key. Document the answers in your decision record so the platform team and the auditors see the same feature boundary.
How to choose by team and environment
A bank with strict data residency rules usually starts from the question of where threat intelligence data may be stored and who may administer the platform. Filigran's SaaS runs each customer in its own infrastructure tenant, so the first step is confirming whether that tenant location and the operating model satisfy your residency and outsourcing policies. If they do not, self-hosting keeps the data inside your cloud account or data center, but then your team owns the Enterprise Edition agreement and the full stack.
- Residency mapping: Ask Filigran which regions host SaaS tenants and whether your data classification allows that location.
- Outsourcing review: SaaS moves operations to a vendor, which typically triggers third-party risk review under your own policy.
- Self-hosted control: Running OpenCTI in your own accounts keeps administration, backups and network paths under your change process.
- EE agreement: Self-hosting Enterprise Edition requires a signed Filigran Enterprise agreement, so legal review is needed either way.
- Evidence: Filigran's SaaS page lists SOC 2 Type 2 and ISO 27001:2022 badges, which you should request as reports through their trust page rather than accept as proof.
Confirm residency, outsourcing approval and the scope of any vendor attestations with your compliance lead before comparing costs.
A public sector team on an air-gapped network cannot use a vendor-hosted SaaS tenant that depends on outbound connectivity from its enclave. The practical choice is self-hosting inside the isolated network, which means every dependency must be available inside that boundary. OpenCTI needs Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage, and connectors that pull external feeds need a planned route for offline updates.
- Connectivity: SaaS assumes access from your side to the vendor, which an air-gapped enclave usually cannot provide.
- Dependency mirroring: Plan how container images, connector updates and dependency packages reach the enclave through your approved transfer process.
- Licensing for isolated use: Enterprise Edition features need a signed agreement and a license, so confirm the license mechanics for disconnected installs with Filigran before design.
- Feed strategy: Connectors that import MISP, MITRE or CVE data depend on upstream sources, so decide which feeds are permitted and how they are refreshed.
- Accreditation: Your authorizing body will ask for the documented architecture, so the platform must be described fully in your own system documentation.
Ask Filigran directly how EE licensing and updates work on an isolated network, since no supplied fact covers this case.
A lean CTI team without platform engineers usually values predictable operations more than control over the stack. Filigran's SaaS includes hardening, monitoring and updates performed by Filigran, a standard support package with two health checks per year and one annual workshop, and Enterprise Edition features. Self-hosting shifts all of that work to your staff, which only makes sense if someone on the team can run the dependencies and upgrade cadence.
- Operations load: Self-hosting means your team patches the platform, its workers, connectors and the search, queue and cache layers.
- Included support: The standard SaaS support package covers health checks and an annual workshop, which is worth comparing with any retainer you would buy for self-hosting.
- Sizing choice: SaaS offers Medium and Large dedicated sizes, while self-hosting lets you choose resources yourself.
- Pricing basis: Filigran states SaaS pricing depends on resources only, not users or integrations, so growth in analysts costs nothing extra, though a quote is needed to see the total.
- Upgrade cadence: Non-LTS releases ship from daily to weekly, so a small team must decide whether it can keep up or needs an LTS line.
Ask for a written quote that lists the included support, the sizing you need and what happens during upgrades.
A team that already runs Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage has most of OpenCTI's dependencies in place. That lowers the cost of self-hosting, but the existing platforms still need capacity and version checks. OpenCTI requires Elasticsearch 8.0 or later or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage such as MinIO, so older clusters may need upgrades before OpenCTI can use them.
- Version check: Confirm your Elasticsearch, OpenSearch, Redis and RabbitMQ versions meet the documented minimums.
- Capacity: Documented sizing asks for 2 cores and at least 8 GB RAM for the platform, and 2 cores, 8 GB RAM and 16 GB SSD for the search layer, so shared clusters need headroom.
- Isolation: Sharing a search cluster with other workloads adds coupling, so decide whether OpenCTI gets dedicated indices or nodes.
- Worker ratio: The documentation recommends at least one platform node for every 3 workers, which affects how many nodes you run.
- Edition gates: Existing infrastructure does not remove the need for an EE agreement if you need SSO, audit logs or playbooks.
Review the dependency versions and capacity with your platform team before deciding that existing infrastructure makes self-hosting cheaper.
What your team runs in each model
This table sets out who patches, monitors, backs up, sizes and upgrades OpenCTI under Filigran SaaS and under a self-hosted deployment. Read each row as a question to answer with your own team and your Filigran agreement in hand, since the split of duties depends on the contract.
| Operating task | Filigran SaaS | Self-hosted OpenCTI |
|---|---|---|
| Platform sizing | Choose Medium (8 vCPU, 32 GB memory, 256 GB storage) or Large (16 vCPU, 64 GB memory, 512 GB storage) with Filigran | Your team sizes the platform (at least 2 cores and 8 GB RAM) and search nodes (2 cores, 8 GB RAM, 16 GB SSD) |
| Dependencies to run | Filigran operates the stack, including the search, cache, message and storage services | You run Elasticsearch 8.0+ or OpenSearch 2.9+, Redis 7.1+, RabbitMQ 3.11+ and S3-compatible storage |
| Patching and hardening | Filigran hardens and updates instances, per its SaaS page | Your team applies OS, container and dependency patches and the hardening you define |
| Monitoring | Filigran monitors instances, per its SaaS page; confirm alert routing into your SOC | Your team builds and runs monitoring, alerting and capacity tracking |
| Backup and restore | Confirm backup frequency, retention and restore tests in the written scope | Your team designs, tests and documents backup and restore for every stateful component |
| Enterprise Edition licensing | Included: SaaS tiers run EE, and EE licenses are provided to SaaS customers | Requires a signed Filigran Enterprise agreement before running EE on premises |
| LTS upgrades | Confirm with Filigran which release line your instance follows and how upgrades are scheduled | LTS builds need an LTS license key; after one month of stabilization they receive only critical bug and security fixes |
| Support scope | Standard support package included, with two health checks and one annual workshop per the SaaS page | Support depends on your agreement and any retainer you buy; confirm response terms in writing |
How cost is structured in each model
Filigran's SaaS pricing is based on resources only, not on users or integrations. The two dedicated OpenCTI sizes are Medium (8 vCPU, 32 GB memory, 256 GB storage) and Large (16 vCPU, 64 GB memory, 512 GB storage), and both include unlimited users, connectors and integrations. Filigran's Software as a Service page publishes no prices and directs buyers to contact sales, so the recurring subscription figure has to come from a written quote. Ask whether the quote covers only the instance size or also storage growth, backups, extra environments and any overage terms, and whether the Enterprise Edition license and standard support package are included in the same price. Confirm the renewal and resizing terms before you sign.
Self-hosting moves most of those costs onto your own budget. Infrastructure is recurring: compute, memory and storage for the platform, Elasticsearch or OpenSearch, Redis, RabbitMQ, S3-compatible storage and the Python workers and connectors. The documented sizing starts at 2 cores and 8 GB RAM for the platform and 2 cores, 8 GB RAM and 16 GB SSD for the search layer, and it recommends at least one platform node for every 3 workers, so the footprint grows with connector volume. Staff time for upgrades, backups, monitoring and on-call is recurring too. The Enterprise Edition agreement is a separate, one-time signed contract with Filigran that you must have before self-hosting EE. Ask Filigran for its terms, including what is licensed, for how long and whether it renews.
If you engage DeployOpen to plan, implement, harden, back up or document a self-hosted deployment, that work is a fixed-scope engagement with scope, deliverables and timelines agreed in writing before work starts, and the quote follows from that scope. Ongoing support, upgrades and testing are available as retainers, which are recurring. Ask for the deliverables listed by name, the environment and dependencies in scope, who performs each task, what is excluded, how changes to scope are priced, and whether the retainer covers LTS upgrades. Compare the total of those lines, plus your own staff time, against the Filigran SaaS quote for the same size and retention period.
How to move between self-hosted and SaaS
This sequence gets an OpenCTI deployment from one hosting model to the other without losing intelligence data, connector behavior or user access. Each step ends with a check you can record, so the cutover happens only after the target instance has been validated.
Confirm edition and licensing agreement
Confirm which OpenCTI edition each side runs before anything moves. Filigran's SaaS tiers run the Enterprise Edition, and Filigran provides EE licenses automatically to SaaS customers. Moving back to self-hosting requires a signed Filigran Enterprise agreement, while a Community Edition deployment on your side needs no agreement. Ask Filigran to confirm the agreement terms, the release line you will receive, and whether the version on each side matches. Done when the signed agreement or the confirmed Community Edition scope is on file.
Size the target instance
Choose the target footprint from the current data volume and connector load. Filigran's SaaS sizes are Medium (8 vCPU, 32 GB memory, 256 GB storage) and Large (16 vCPU, 64 GB memory, 512 GB storage), both with unlimited users, connectors and integrations. A self-hosted target needs the platform, Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible storage sized to match, with at least one platform node for every three workers. Ask Filigran to confirm how the SaaS storage limit maps to your current data. Done when the target size and storage headroom are written down and approved.
Export and validate STIX data
Export the knowledge base in STIX form and load it into a non-production target. OpenCTI stores its data as STIX-based entities and relationships, so compare entity counts, relationships, markings and labels between source and target for a representative sample. Confirm with Filigran whether it provides a migration path and which export format it supports, because exact tooling is not covered here. Done when sampled objects match on source and target and every difference is logged and explained.
Reconfigure connectors and integration keys
Rebuild the connector configuration on the target, including MISP, MITRE and CVE connectors, enrichment and export connectors, and stream consumers. Connector tokens, API endpoints and schedules usually change when the platform moves, so update each one in a staging run first. Check that imports and exports produce the same objects on the target as on the source. Done when each connector completes a test run against the target and the results match the source.
Migrate identity and user access
Recreate user groups, roles, organization segregation and single sign-on on the target. SSO through OpenID, LDAP or SAML and organization segregation are Enterprise Edition features, so confirm they are enabled in the edition you will run. Test sign-in for each role with a pilot group before opening access. Done when every pilot user signs in with the expected role and no user can see data outside their organization.
Cut over connectors and users
Schedule a window in which the source stops ingesting and the target becomes authoritative. Pause source connectors, run a final delta export, confirm it loaded on the target, then switch DNS, connector endpoints and user bookmarks. Ask Filigran to confirm its change process and support coverage for this window. Done when the source has no active connectors, the target has the final delta, and users report access.
Retire the old instance
Keep the source instance in read-only mode for a period you agree with your records and compliance owners, then decommission it. Before deletion, confirm that backups of the source are retained according to your policy, and that any licenses or agreements tied to the old deployment are closed out. Done when retention is documented, the source is shut down, and the decommission record is signed off.
Questions buyers ask before choosing a hosting model
What actually drives the cost of self-hosting OpenCTI versus buying the SaaS?
Self-hosting moves cost onto your own infrastructure and staff: compute, storage, and the Elasticsearch or OpenSearch, Redis, RabbitMQ and S3-compatible services OpenCTI depends on, plus the people who patch, back up and upgrade them. Filigran's SaaS is priced on resources only, never on users or integrations, and the page publishes no prices, so the comparison depends on a quote. Ask Filigran for SaaS pricing against the Medium (8 vCPU, 32 GB memory, 256 GB storage) and Large (16 vCPU, 64 GB memory, 512 GB storage) sizes, and model your own cloud or data center costs for the same footprint. Ask what is one-time and what recurs in each case.
Can we self-host OpenCTI without signing a vendor agreement?
Yes, for the Community Edition. The Apache License 2.0 Community Edition can be self-hosted without a Filigran agreement. Self-hosting the Enterprise Edition requires a signed Filigran Enterprise agreement, and EE gates capabilities such as audit logs, playbooks and automation, organization segregation and SSO through OpenID, LDAP or SAML. Confirm with Filigran which edition your requirements need before you build the platform, because the agreement and the feature set both depend on it.
How long does a move between SaaS and self-hosting take, and what does it need from staff?
The duration depends on data volume, connector count, integrations, and how much of the stack your team already runs. A self-hosted deployment needs people who can operate Elasticsearch or OpenSearch, Redis, RabbitMQ and object storage, and who can keep Python workers and connectors healthy. Ask Filigran and any implementation partner for a written timeline and a list of the skills required, and confirm whether your staff can own upgrades on the release cadence you choose.
Does Filigran SaaS include support and health checks?
A standard support package is included with all Filigran cloud hosting plans, and it includes two health checks per year and one annual workshop. Each SaaS instance runs in its own infrastructure tenant, and Filigran hardens, monitors and updates it. Confirm the response times, escalation paths and any extra services in the written agreement, since the page does not describe them in detail.
Can DeployOpen help with self-hosting OpenCTI or moving from SaaS?
DeployOpen plans, implements, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. Most engagements are fixed-scope, with scope, deliverables and timelines agreed in writing before work starts, and a quote follows from that scope. Ongoing support and upgrades are available as retainers. DeployOpen is not an official partner or reseller of Filigran, so confirm with Filigran which licensing and EE terms apply to your deployment.
When should we choose an LTS line instead of the regular OpenCTI release?
Choose an LTS line when your team values a predictable upgrade rhythm over the newest features. Regular releases ship when ready, from daily to weekly, while LTS releases occur every 6 months and are supported for 1 year, with a 6-month overlap between consecutive LTS versions. LTS releases are distributed as container images but require a specific LTS license key, and after a one-month stabilization they receive only critical bug and security fixes. Ask Filigran which LTS key applies to a self-hosted deployment and which tier your SaaS instance follows.
What does a self-hosted OpenCTI deployment break first when it is under-resourced?
The usual first failures come from the dependencies rather than the platform itself: Elasticsearch or OpenSearch running short of memory or disk, RabbitMQ queues backing up behind slow workers, and connectors failing silently. The documented sizing gives the platform 2 cores and at least 8 GB RAM, the search cluster 2 cores, 8 GB RAM and 16 GB SSD, and recommends at least one platform node for every 3 workers. Treat these as minimums from the deployment overview, and load-test with your own feed volume before production.
How we work through an OpenCTI hosting decision
This sequence shows how DeployOpen works through the choice between running OpenCTI yourself and buying Filigran's managed SaaS. Each step closes with a written output you can check, so the decision rests on evidence rather than assumptions.
Confirm the hosting question and constraints
We start by writing down what the platform must do and where its data may sit. Your team confirms data residency rules, whether intelligence is shared with external parties, how many analysts and connectors will load data, and which cloud accounts, data centers or air-gapped networks are in scope. The output is a short requirements note that both hosting options are measured against. The step is done when your security lead signs off on that note.
Map required capabilities to editions
We check each requirement against the edition that provides it. The Community Edition is licensed under Apache-2.0, while audit logs, playbooks and automation, organization segregation and SSO through OpenID, LDAP or SAML are documented as Enterprise Edition features. Filigran's SaaS tiers run the Enterprise Edition, so those features are part of that option. Confirm with Filigran which features your contract includes. The output is a requirement-to-edition table.
Size the self-hosted dependency stack
We list every service a self-hosted deployment needs and estimate the footprint from documented minimums. OpenCTI depends on Elasticsearch 8.0 or later or OpenSearch 2.9 or later, Redis 7.1 or later, RabbitMQ 3.11 or later and S3-compatible storage. The deployment documentation lists 2 cores and at least 8 GB RAM for the platform, and 2 cores, 8 GB RAM and 16 GB SSD for Elasticsearch or OpenSearch, with at least one platform node for every three workers. We treat these as starting points and size against your expected connector load and retention. The output is a hardware and service inventory.
Confirm the Enterprise agreement path
We confirm the licensing route before any build decision is made. Self-hosting OpenCTI Enterprise Edition requires a signed Filigran Enterprise agreement, while the Community Edition can be self-hosted without one. Filigran's SaaS includes Enterprise Edition licensing for its customers. We ask Filigran to confirm terms in writing, including what a self-hosted agreement covers and how LTS license keys apply. The output is a licensing note your procurement team can review.
Write scope and deliverables in writing
We turn the chosen option into a fixed scope with deliverables, timelines and responsibilities agreed in writing before work starts. For a self-hosted build, that covers deployment, integration, hardening, backup, upgrades and documentation inside your infrastructure. For the SaaS route, scope covers the work we would review or integrate, not operation of Filigran's tenant. Quotes follow from this written scope, and DeployOpen does not publish a price list. The output is a signed scope document.
Build and harden in your environment
For a self-hosted build, we install and configure the platform, workers, connectors and dependencies in the cloud accounts, data centers or air-gapped networks you name. We apply hardening, configure SSO and audit logging where the chosen edition supports them, and test connector behavior against your real sources. The step closes when the deployment passes the acceptance tests listed in the scope document.
Hand over runbooks, evidence and upgrade plan
We deliver runbooks, configuration records and an upgrade plan that follows OpenCTI's release model. Regular releases ship when ready, while LTS releases are supported for one year and receive only critical bug and security fixes after stabilization. Evidence packs help your compliance team prepare for assessment, but DeployOpen does not issue audit reports or certifications, and independent auditors do. Ongoing upgrades and testing can run under a retainer. The step closes when your team completes a restore test.
