Threat Intelligence And Digital Forensics — hobby stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS + ~$20/mo VM (2 vCPU/4GB); OpenCTI CE Free + ~$40/mo VM+OpenSearch; ThreatConnect $40k/yr (~$3333/mo) 5 users; Anomali $50k/yr (~$4166/mo) 10 users/1M IOCs/mo; Recorded Future $100k/yr (~$8333/mo) unlimited users/API 5M req/mo
Malware Analysis Sandbox
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAny.Run Free: 5 tasks/day public, 10min analysis; Pro $299/mo 100 private tasks + $0.10/task overage; CAPE Free + ~$50/mo VM; Joe Sandbox Cloud Pro $25k/yr (~$2083/mo) 5k tasks/mo; Ultimate $50k/yr (~$4166/mo) 10k tasks/mo; Any.Run Private Cloud from $10k/mo
Digital Forensics Tool (Disk & Memory)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAutopsy Free OSS; Volatility Free OSS; FTK Imager Free; FTK Toolkit $4000/yr/license (~$333/mo); FTK Lab $8000/yr (~$666/mo); EnCase Forensic $4000/yr/license or $7500 one-time; Magnet AXIOM $4500/yr (~$375/mo) per examiner, AXIOM Cyber $6500/yr (~$541/mo)
Evidence Collection & WORM Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3 Object Lock Free feature + Storage: $0.023/GB-mo Standard, $0.0125/GB-mo IA, $0.004/GB-mo Glacier Instant, $0.00099/GB-mo Deep Archive; PUT $0.005/1k; Backblaze B2 $0.006/GB-mo storage + $0.01/GB download; Wasabi $6.99/TB-mo ($0.00699/GB) no egress/API, 90-day min
Threat Feed / IOC Aggregation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX Free unlimited pulses/OTX API; Abuse.ch Free unlimited; Shodan Membership $59 one-time + Free 100 query/mo; Shodan Pro $59/mo 10k results; GreyNoise Free 100 req/day, Pro $500/mo 50k req, Enterprise $1800/mo; VirusTotal Free 4 req/min 500/day 15k/mo; Enterprise $30k/yr (~$2500/mo) 750k req/mo $0.004/req overage; VT Hunting add-on $10k/yr (~$833/mo)
SIEM for Threat Intel Correlation
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh Free OSS + ~$50/mo VM 4vCPU; Panther Free 500GB ingested/mo then $0.10/GB after; Elastic Cloud $95/mo 2GB RAM/50GB storage $0.10/GB over; Splunk Cloud $150/GB/mo ingested (approx $1800/TB/yr) min $2000/yr + Enterprise license; Sentinel $2.46/GB ingested + $0.10/GB 90d retention; Chronicle $5/GB ingested
Secrets Management for Intel API Keys
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free + ~$30/mo VM; Infisical OSS Free; Doppler Free 50 secrets 1000 API calls/day then $18/mo Starter; Vault Cloud $0.03/hr dev (~$22/mo) Standard $0.10/hr (~$73/mo) + $0.03/10k req; AWS Secrets Manager: first 30 days free then $0.40/secret/mo + $0.05/10k API; Azure KV $0.03/10k ops + HSM $1.45/HSM-mo
IOC / Artifact Repository (Object Storage)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsMinIO Free AGPL + ~$15/mo 1TB VM disk; Backblaze B2 $0.006/GB-mo storage $0.01/GB egress; Wasabi $6.99/TB-mo $0.00699/GB no egress/API fees 90-day min; AWS S3 $0.023/GB-mo Standard, Intelligent-Tiering $0.023-$0.0125 auto, $0.00099 Deep Archive; S3 Inventory $0.0025/M objects listed
Reverse Engineering Environment
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsGhidra Free OSS; REMnux Free OVA; x64dbg Free; IDA Free Free non-commercial; IDA Pro $2999/yr per seat (~$250/mo) + Hex-Rays $3299/yr; Binary Ninja Personal $299 one-time (perpetual), Commercial $1199/yr (~$99/mo), Cloud $50/mo per user; radare2 Free
Network Traffic Analysis / PCAP Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsZeek Free + ~$40/mo VM; Suricata Free OSS; Security Onion Free + ~$100/mo 500GB infra; Arkime Free + ~$100/mo infra; Corelight Virtual Sensor $75k/yr per sensor (~$6250/mo) includes support+cloud; Physical AP 200 $125k one-time + $25k/yr support; CloudShark Teams $399/mo 50GB, Enterprise $999/mo 250GB
Endpoint Timeline / Memory Forensics Compute
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsVolatility Free; KAPE Community Free LE version; Velociraptor Free + ~$50/mo t3.medium; Timesketch Free + ~$40/mo VM; Binalyze AIR Free 25 assets then Enterprise $35k/yr (~$2916/mo) 1000 endpoints $5/endpoint/mo over; Magnet AXIOM $4500/yr (~$375/mo) Cyber $6500/yr (~$541/mo); CrowdStrike Falcon Insight $59.99/endpoint/yr + Forensics add-on $12k/yr (~$1000/mo)
How this hobby threat intelligence and digital forensics checklist works.
Each requirement below is something a hobby threat intelligence and digital forensics build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.