About CTI.watch — Open Source Cyber Threat Intelligence Platform
CTI.watch is a free, open-source Cyber Threat Intelligence platform aggregating real-time threat data from multiple global sources. Built for security analysts, SOC teams and researchers who need a unified, always-on view of the global threat landscape — without paywalls.
What is CTI.watch?
CTI.watch (ctiwatch.com) is an industrial-grade Cyber Threat Intelligence platform designed to aggregate, normalize and surface threat data in real-time. It monitors malicious Indicators of Compromise (IoCs), critical CVE vulnerabilities, APT threat actor activity, ransomware victim reports and active threat campaigns — all from a single interface.
Unlike commercial CTI platforms that charge thousands of dollars per year, CTI.watch is completely free and open-source. The project was built by Lear Security as a practical contribution to the open-source security community.
Intelligence Coverage
Threat Data
- ◈Indicators of Compromise (IPs, domains, URLs, hashes)
- ◈CVE Vulnerabilities with EPSS exploit scoring
- ◈Known Exploited Vulnerabilities (KEV)
- ◈Botnet C2 infrastructure tracking
- ◈Malware family taxonomy
- ◈Ransomware victim monitoring
- ◈APT threat actor profiling
- ◈MITRE ATT&CK TTP mapping
Intelligence Feeds
- ◈Government & national cybersecurity agencies
- ◈Vulnerability databases and advisories
- ◈Threat intelligence community feeds
- ◈Security vendor research blogs
- ◈Ransomware monitoring services
- ◈Open-source threat intelligence (OSINT)
- ◈Malware research repositories
- ◈Cybersecurity news aggregation
How It Works — Technical Pipeline
CTI.watch runs a set of scheduled worker collectors managed by PM2 on a VPS. Each collector fetches data from its source, normalizes the output into a shared schema, deduplicates against existing records in PostgreSQL 16, and writes new entries. Redis 7 serves as an in-memory cache layer for hot queries.
The Next.js 14 frontend communicates exclusively with the Node.js/Express API, proxied through Nginx with TLS 1.3. A Server-Sent Events (SSE) endpoint delivers real-time threat events to connected clients without polling overhead.
Use Cases
Security Analysts
Quickly look up IoCs during incident response. Check if a suspicious IP or domain appears in threat feeds. Cross-reference CVEs affecting your infrastructure with exploit probability scores to prioritize patching.
SOC Teams
Leverage real-time threat data for alert correlation and enrichment workflows. Use the live SSE stream for continuous threat monitoring into dashboards and detection pipelines.
Threat Researchers
Track APT groups and their TTPs with MITRE ATT&CK mapping. Monitor active campaigns and correlate IoCs, malware families, threat actors and victim organizations.
Journalists & Analysts
Monitor ransomware victim data to track attack trends by sector, country and threat group. Get aggregated cybersecurity news from leading security research blogs in a single feed.
Frequently Asked Questions
What is CTI.watch?
CTI.watch (ctiwatch.com) is a free, open-source Cyber Threat Intelligence platform that aggregates real-time threat data from multiple global sources. It provides a unified view of IoCs, CVEs, APT groups, ransomware victims and threat campaigns.
Is CTI.watch free to use?
Yes, CTI.watch is completely free and open-source. The platform is publicly accessible at ctiwatch.com with no registration required.
How often is data updated?
Data is updated continuously at different frequencies depending on the source, ranging from near real-time to every few hours. The platform is always monitoring for new threats.
What data does CTI.watch cover?
CTI.watch covers IoCs (IPs, domains, URLs, file hashes), CVE vulnerabilities with exploit probability scoring, APT threat actors with MITRE ATT&CK TTP mapping, ransomware victim reports, active threat campaigns, and curated cybersecurity news.
How can I use CTI.watch for threat hunting?
Search IoCs via /iocs to check IPs, domains or hashes against threat feeds. Track CVEs affecting your stack via /vulnerabilities with exploit probability scoring. Identify threat actor TTPs via /threats and cross-reference with MITRE ATT&CK. Monitor ransomware groups targeting your sector via /victims.
Contact
Questions, suggestions or partnership inquiries: contact@ctiwatch.com