CrowdSec and Filigran Partner to Deliver Real-Time, Intelligence-Driven Cyber Defense

Filigran x CrowdSec: A Partnership to Empower the Threat Intelligence Community

We’re proud to announce a new partnership between CrowdSec and Filigran, the company behind OpenCTI, one of the world’s leading open source threat intelligence platforms. This collaboration marks a significant step forward in our shared mission: empowering defenders through open, community-driven cybersecurity.

This partnership with Filigran brings our shared vision of collaborative security to life. By joining CrowdSec and OpenCTI, we’re enabling security teams to move faster, respond smarter, and contribute to a threat intelligence ecosystem that benefits everyone.

Andrea Hervier, Global Head of Partnerships, CrowdSec

At CrowdSec, we believe threat intelligence should be real-time, actionable, and community-powered. Our network collects live telemetry from hundreds of thousands of servers worldwide, transforming raw behavioral signals into curated intelligence on malicious IPs, updated every 15 minutes, vetted through a consensus engine, and enriched with deep context.

Thanks to this integration, OpenCTI users can benefit from CrowdSec Threat Intelligence to enrich their IP Observables, and retrieve custom feeds on behaviors and CVEs actively exploited, unlocking major benefits.

Why this matters for OpenCTI Users

• Fresher data, faster decisions: No more doubt about the qualification of a threat, nor stale feeds. CrowdSec delivers IP reputation data data as it’s observed across real production environments, from web servers and APIs to VPN gateways and e-commerce platforms.
• High-confidence indicators: Every IP in our dataset has been confirmed by multiple independent trusted nodes. Our curation process eliminates false positives and prioritizes indicators that matter, helping you cut through the noise.
• Context-rich observables: CrowdSec enriches each IP with up to 30 fields: Attack behaviors, performed CVEs, top targeted countries, and MITRE techniques, allowing for precise correlation with other intelligence.
• Open source + crowd-sourced data = stronger community: This partnership reinforces the idea that defenders shouldn’t have to choose between open platforms and high-quality data. With CrowdSec Threat Intelligence integrated into OpenCTI, users get the best of both worlds: an extensible TIP backed by real-world telemetry.
• Easy integration: Getting started is easy. With our documented connector, CrowdSec feeds can be pulled into OpenCTI in minutes using standard OpenCTI connectors and API keys. No complex engineering required, just immediate value.

This collaboration is a natural fit. Both Filigran and CrowdSec are committed to transparency, interoperability, and strengthening the global defense fabric through open tools and shared intelligence.

Whether you’re a threat hunter, SOC analyst, or CISO, this partnership means one thing: you now have more power, insight, and speed at your fingertips.

Together, we’re building a stronger, smarter, more connected cyber defense community.

About Filigran

Filigran was founded in 2022 with a clear mission: to equip cybersecurity and crisis management teams with great open source software powered by actionable threat intelligence. At the heart of their product suite is OpenCTI, a widely adopted platform that centralizes, contextualizes, and operationalizes threat data, from IP addresses and domains to malware families and attack campaigns. 

With over 4,000 GitHub stars, millions of downloads, and active deployments across both public and private sectors, OpenCTI has established itself as a cornerstone of the open-source CTI ecosystem. Much like CrowdSec, Filigran has built an active and growing community, with more than 6,000 organizations, 5,000 community members, and 300 available connectors. We believe that by combining forces, we can strengthen the fabric of collective defense and make the internet a safer place for everyone.