Who is Filigran?
Filigran is a private cybersecurity software company focused on open source threat intelligence, detection engineering, and security operations platforms used to structure, share, and operationalize cyber threat data in enterprise environments.
- Open source cyber threat intelligence platforming and knowledge management
- Support for STIX, TAXII, MITRE ATT&CK, and related CTI data models
- Detection engineering and security operations workflow tooling
- Capabilities for analysis, collaboration, enrichment, and dissemination of threat data
- Use in SOC, CERT, CSIRT, and threat intelligence team environments
Show more
More About Filigran
Filigran operates as a software company in cybersecurity, with offerings centered on helping organizations manage cyber threat intelligence and related security operations data. In enterprise settings, its platforms are used by threat intelligence teams, security operations centers, incident response groups, and public sector or regulated-sector security functions that need structured ways to collect, correlate, and distribute intelligence.
The company is closely associated with OpenCTI, an open source cyber threat intelligence platform, which is used to model relationships among adversaries, campaigns, indicators, malware, vulnerabilities, and defensive measures. That positioning places Filigran within the threat intelligence and security operations software market rather than endpoint, network perimeter, or identity control categories. Its technology is typically applied upstream of enforcement systems, serving as an intelligence layer that organizes data for analyst use and downstream integrations.
Architecturally, Filigran is associated with standards and frameworks commonly used in CTI programs, including STIX and TAXII for intelligence representation and exchange, and MITRE ATT&CK for adversary behavior mapping. In practice, these standards matter because enterprises often need to normalize data from multiple feeds, internal investigations, vulnerability sources, and external sharing communities. Platforms in this category are often integrated with SIEM, SOAR, case management, and detection tooling so analysts can move from raw intelligence to operational use.
Compared with adjacent categories such as SIEM or SOAR, Filigran's focus is narrower and more data-model oriented: it centers on intelligence curation, knowledge graph style relationship mapping, and dissemination rather than broad log analytics or automated response orchestration. That makes its offerings relevant to organizations building formal CTI programs, information sharing workflows, or ATT&CK-aligned detection engineering practices. As a private company software vendor, Filigran is positioned around enterprise cybersecurity use cases tied to threat intelligence management, detection content operations, and collaborative security analysis.
Our description of Filigran. Updated September 2026.
