Threat Intelligence And Digital Forensics — small scale stack.
For each requirement below, pick the option that fits your build — recommended first, then free and cheaper alternatives — or skip what your project doesn't need. Tap the info icon next to any requirement to see why it matters.
Threat Intelligence Platform (TIP)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsMISP Free OSS + ~$20/mo VM (2 vCPU/4GB); OpenCTI CE Free + ~$40/mo VM+OpenSearch; ThreatConnect $40k/yr (~$3333/mo) 5 users; Anomali $50k/yr (~$4166/mo) 10 users/1M IOCs/mo; Recorded Future $100k/yr (~$8333/mo) unlimited users/API 5M req/mo
Malware Analysis Sandbox
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAny.Run Free: 5 tasks/day public, 10min analysis; Pro $299/mo 100 private tasks + $0.10/task overage; CAPE Free + ~$50/mo VM; Joe Sandbox Cloud Pro $25k/yr (~$2083/mo) 5k tasks/mo; Ultimate $50k/yr (~$4166/mo) 10k tasks/mo; Any.Run Private Cloud from $10k/mo
Digital Forensics Tool (Disk & Memory)
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsAutopsy Free OSS; Volatility Free OSS; FTK Imager Free; FTK Toolkit $4000/yr/license (~$333/mo); FTK Lab $8000/yr (~$666/mo); EnCase Forensic $4000/yr/license or $7500 one-time; Magnet AXIOM $4500/yr (~$375/mo) per examiner, AXIOM Cyber $6500/yr (~$541/mo)
Evidence Collection & WORM Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsS3 Object Lock Free feature + Storage: $0.023/GB-mo Standard, $0.0125/GB-mo IA, $0.004/GB-mo Glacier Instant, $0.00099/GB-mo Deep Archive; PUT $0.005/1k; Backblaze B2 $0.006/GB-mo storage + $0.01/GB download; Wasabi $6.99/TB-mo ($0.00699/GB) no egress/API, 90-day min
Threat Feed / IOC Aggregation
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsOTX Free unlimited pulses/OTX API; Abuse.ch Free unlimited; Shodan Membership $59 one-time + Free 100 query/mo; Shodan Pro $59/mo 10k results; GreyNoise Free 100 req/day, Pro $500/mo 50k req, Enterprise $1800/mo; VirusTotal Free 4 req/min 500/day 15k/mo; Enterprise $30k/yr (~$2500/mo) 750k req/mo $0.004/req overage; VT Hunting add-on $10k/yr (~$833/mo)
SIEM for Threat Intel Correlation
Keeps you secure and compliant with regulations. Required for enterprise customers and handling sensitive data.Pricing & free-tier limitsWazuh Free OSS + ~$50/mo VM 4vCPU; Panther Free 500GB ingested/mo then $0.10/GB after; Elastic Cloud $95/mo 2GB RAM/50GB storage $0.10/GB over; Splunk Cloud $150/GB/mo ingested (approx $1800/TB/yr) min $2000/yr + Enterprise license; Sentinel $2.46/GB ingested + $0.10/GB 90d retention; Chronicle $5/GB ingested
Secrets Management for Intel API Keys
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsVault OSS Free + ~$30/mo VM; Infisical OSS Free; Doppler Free 50 secrets 1000 API calls/day then $18/mo Starter; Vault Cloud $0.03/hr dev (~$22/mo) Standard $0.10/hr (~$73/mo) + $0.03/10k req; AWS Secrets Manager: first 30 days free then $0.40/secret/mo + $0.05/10k API; Azure KV $0.03/10k ops + HSM $1.45/HSM-mo
IOC / Artifact Repository (Object Storage)
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsMinIO Free AGPL + ~$15/mo 1TB VM disk; Backblaze B2 $0.006/GB-mo storage $0.01/GB egress; Wasabi $6.99/TB-mo $0.00699/GB no egress/API fees 90-day min; AWS S3 $0.023/GB-mo Standard, Intelligent-Tiering $0.023-$0.0125 auto, $0.00099 Deep Archive; S3 Inventory $0.0025/M objects listed
Reverse Engineering Environment
Stores API keys and credentials safely, separate from your code. Leaking secrets is one of the most common breaches.Pricing & free-tier limitsGhidra Free OSS; REMnux Free OVA; x64dbg Free; IDA Free Free non-commercial; IDA Pro $2999/yr per seat (~$250/mo) + Hex-Rays $3299/yr; Binary Ninja Personal $299 one-time (perpetual), Commercial $1199/yr (~$99/mo), Cloud $50/mo per user; radare2 Free
Network Traffic Analysis / PCAP Storage
Where you keep files users upload or you serve — images, videos, documents — and how fast they reach visitors around the world.Pricing & free-tier limitsZeek Free + ~$40/mo VM; Suricata Free OSS; Security Onion Free + ~$100/mo 500GB infra; Arkime Free + ~$100/mo infra; Corelight Virtual Sensor $75k/yr per sensor (~$6250/mo) includes support+cloud; Physical AP 200 $125k one-time + $25k/yr support; CloudShark Teams $399/mo 50GB, Enterprise $999/mo 250GB
Endpoint Timeline / Memory Forensics Compute
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsVolatility Free; KAPE Community Free LE version; Velociraptor Free + ~$50/mo t3.medium; Timesketch Free + ~$40/mo VM; Binalyze AIR Free 25 assets then Enterprise $35k/yr (~$2916/mo) 1000 endpoints $5/endpoint/mo over; Magnet AXIOM $4500/yr (~$375/mo) Cyber $6500/yr (~$541/mo); CrowdStrike Falcon Insight $59.99/endpoint/yr + Forensics add-on $12k/yr (~$1000/mo)
Vulnerability Intelligence / CVE DB Hosting
Where your code actually runs and serves requests. Picking the right host affects speed, scaling, and how much ops work you do.Pricing & free-tier limitsNVD API Free 50 req/30s no key, 300 req/30s with key unlimited; cve-search OSS Free + ~$20/mo 40GB VM + Mongo; Vulners Free 100/day, Startup $200/mo 10k req/day, Business $500/mo 100k/day; VulnDB Commercial $30k/yr (~$2500/mo) 5 users; Recorded Future Vuln Module included $100k/yr Enterprise or +$20k/yr add-on
Dark Web Monitoring / OSINT Crawler Infra
Tells you when things break and why. You cannot fix what you cannot see — this is how you keep downtime short.Pricing & free-tier limitsTor Free; SpiderFoot OSS Free + ~$30/mo VM; Hunchly $129.99/yr (~$11/mo); IntelX.io Free 100 searches/mo then $60/mo Pro 1000; SpyCloud $40k/yr (~$3333/mo) base 3 users API 100k queries/mo $0.03 over; SearchLight $50k/yr (~$4166/mo) 5k dark web queries; ZeroFox $50k/yr (~$4166/mo) min
DNS / Passive DNS Logging
Your human-readable address on the web plus the DNS records that point it at your servers. Skipping this is not an option — users need a domain to reach you.Pricing & free-tier limitsPi-hole Free; SecurityTrails Free 50 queries/mo, Pro $299/mo 10k queries $0.02 over; Farsight DNSDB Flex $199/mo 5000 queries, Standard $1995/mo unlimited user 500k queries/mo; RiskIQ PassiveTotal $15k/yr (~$1250/mo) base; VirusTotal Passive DNS included Enterprise $30k/yr (~$2500/mo)
Certificate Transparency Monitoring
Encrypts traffic between your users and your servers. Without it browsers flag your site as insecure and you lose trust and search ranking.Pricing & free-tier limitscrt.sh Free unlimited web/API; CertStream Free firehose + ~$15/mo consumer VM; Censys Free 250 queries/mo, Search Team $999/mo 10k queries/day $0.10/overage 100k/mo, Enterprise $5000/mo; Shodan Monitor Free 1 network + Pro $129/mo 2M scan credits, Enterprise $999/mo; SecurityTrails CT included Pro $299/mo
Honeypot / Deception Infrastructure
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsT-Pot Free OSS + ~$30/mo VPS 4GB; OpenCanary Free; CanaryTokens.org Free unlimited tokens; Thinkst Canary Free 1 Canary, Starter $7500/yr 5 canaries (~$625/mo) + $15/canary/mo over; Scale $15k/yr 20 birds; Enterprise $50k/yr (~$4166/mo) 100 birds; Attivo/SentinelOne Deception $30k/yr (~$2500/mo) base 50 deceptions
Threat Actor Attribution Graph DB
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsNeo4j Community Free + ~$40/mo VM 200k nodes; Aura Free 200k nodes 0.5GB then Professional $0.18/hr DB (~$130/mo) + $0.21/GB-hr storage; ArangoDB Free community; TigerGraph Cloud Free 100GB then $0.20/hr instance (~$146/mo) + storage $0.023/GB; AWS Neptune Serverless $0.15/NCU-hr (~$108/mo min) + $0.20/GB-mo
Case Management / Incident Response Platform
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsTheHive 5 Free OSS + ~$30/mo VM; Cortex Free OSS; IRIS Free OSS; Jira Cloud Free 10 users then Standard $8.15/user/mo (~$815/mo 100 users) Premium $16/user/mo; ServiceNow SecOps $40k/yr (~$3333/mo) base 5 users Standard; PagerDuty Free 5 users + Team $29/user/mo (~$290/mo 10 users) Business $49/user/mo
Automated IOC Enrichment / SOAR Trigger
A piece of your stack you may or may not need, depending on scope. Pick the option that fits — or skip it if your project doesn’t require this capability yet.Pricing & free-tier limitsShuffle Free self-hosted unlimited + Cloud Free 10k exec/mo then Pro $500/mo 100k exec; n8n OSS Free self-hosted + Cloud Starter $20/mo 2.5k execs 5 workflows $0.01/exec over; Tines Community Free 10k tasks $0.02/task over, Pro $500/mo 50k tasks, Enterprise $2500/mo; Cortex XSOAR $75k/yr (~$6250/mo) 1000 actions/day; Splunk SOAR $30k/yr (~$2500/mo) 10k actions/mo $0.05/action over; Swimlane $60k/yr (~$5000/mo)
How this small scale threat intelligence and digital forensics checklist works.
Each requirement below is something a small scale threat intelligence and digital forensics build typically needs. Pick one of the four researched options — recommended, free, cheaper or paid — add your own with "Other", or skip the requirement if your project doesn't need it. Nothing is mandatory; the plan on the right tracks what you've decided so nothing gets forgotten.
Your picks are saved in this browser automatically, so you can come back anytime. Options are researched per build level and refreshed as vendors change their plans — always verify details on the provider's page before committing.