OpenPanel
OpenPanel's 3.x line hits six builds in 36 hours, still without release notes.
Comparison · Analytics
Evidence vs OpenCTI
A side-by-side editorial comparison of Evidence and OpenCTI — release velocity, themes, recent moves, and the top alternatives to consider.
Evidence vs OpenCTI: at a glance
What is Evidence?
Evidence's last release was a February CVE sweep that also removed Evidence Cloud references.
Every tracked Evidence release is from a single day, February 6, 2026: a coordinated patch across the SDK, preprocessor, universal SQL layer and database connectors to pick up dependency updates for CVEs. The SDK patch also removes references to Evidence Cloud.
What is OpenCTI?
OpenCTI's weekly train now merges entities in the knowledge view and reads defanged IOCs.
Filigran ships an OpenCTI weekly build plus backports to two LTS lines (7.2603 and 7.2608). The 10-16 weekly lets analysts merge entities directly from the knowledge view, search defanged indicators globally, collapse the ATT&CK pattern matrix and trim empty sections from generated Fintel reports. Earlier weeklies added enrichment from investigations, chatbot quotas and manual security coverage.
Evidence vs OpenCTI: editorial side-by-side
Evidence
0.0ANALYTICS
Evidence's last release was a February CVE sweep that also removed Evidence Cloud references.
◆ Current state
Every tracked Evidence release is from a single day, February 6, 2026: a coordinated patch across the SDK, preprocessor, universal SQL layer and database connectors to pick up dependency updates for CVEs. The SDK patch also removes references to Evidence Cloud.
◆ Where it's heading
Nothing has shipped in the eight months since, so the open-source BI-as-code framework looks to be in maintenance mode. Removing Evidence Cloud references suggests the hosted offering has been dropped or separated, though the entries do not say why.
◆ Prediction
It is unclear from the entries whether active development will resume; the next release is more likely another dependency or security patch than new features.
OpenCTI
5.0ANALYTICS
OpenCTI's weekly train now merges entities in the knowledge view and reads defanged IOCs.
◆ Current state
Filigran ships an OpenCTI weekly build plus backports to two LTS lines (7.2603 and 7.2608). The 10-16 weekly lets analysts merge entities directly from the knowledge view, search defanged indicators globally, collapse the ATT&CK pattern matrix and trim empty sections from generated Fintel reports. Earlier weeklies added enrichment from investigations, chatbot quotas and manual security coverage.
◆ Where it's heading
The arc is analyst ergonomics inside the knowledge graph: fewer context switches to deduplicate, enrich and report, layered on an access-control hardening pass that the LTS patches backport. Many long-standing feature requests (some with issue numbers in the 8,000-14,000 range) are now landing, which suggests a backlog-clearing phase.
◆ Prediction
Expect more old knowledge-view and filter requests to close in coming weeklies, and LTS patches that backport this month's access fixes. The entries don't show when a new LTS line will be cut.
Alternatives to Evidence and OpenCTI
Other Analytics products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Evidence or OpenCTI.
OpenHouse
OpenHouse starts simplifying replication by making its catalog, not Iceberg metadata, the source.
Basedash
Basedash adds view-only seats so whole departments can read dashboards without editing.
OpenReplay
OpenReplay adds offline license tokens so air-gapped installs can run licensed.
Tinybird
Tinybird switches off Classic for Free and Developer plans, leaving Forward as the only path.
Fulcrum
Fulcrum gives admins one FastFill Settings panel while Photo FastFill stays in Alpha.
See all Evidence alternatives → · See all OpenCTI alternatives →
Recent activity from Evidence and OpenCTI
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 2d agoOpenCTIEntity merge in knowledge view, defanged search, Fintel trimming
- 4d agoOpenCTIEnrichment from investigations, custom fields, 30+ fixes
- 10d agoOpenCTIWeekly build 7.261008.0 ships without release notes
- 11d agoOpenCTILTS 7.2603 patch: feed identity confinement and org segregation fixes
- 16d agoOpenCTIChatbot quotas and feedback, one-click investigation duplication
- 18d agoOpenCTILTS security patch: allowlist bypass and dashboard access fixes
- 8mo agoEvidenceSQLite connector picks up CVE-patched shared dependency
- 8mo agoEvidencePreprocessor package updates to resolve CVEs
- 8mo agoEvidenceTrino connector picks up CVE-patched shared dependency
- 8mo agoEvidenceSDK patches CVEs and removes Evidence Cloud references
- 8mo agoEvidenceRedshift connector picks up CVE-patched dependencies
- 8mo agoEvidenceSnowflake connector picks up CVE-patched shared dependency
Frequently asked questions
What is the difference between Evidence and OpenCTI?
They serve adjacent needs but don't currently overlap on shipped themes. OpenCTI is currently shipping more aggressively (velocity 5.0 vs 0.0), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Evidence better than OpenCTI?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. OpenCTI is currently shipping more aggressively (velocity 5.0 vs 0.0), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Analytics products to evaluate alongside.
What are the best alternatives to Evidence?
Top Evidence alternatives in Analytics are ranked by recent ship velocity. Browse the "Evidence alternatives" section above for the current picks, or visit /alternatives/evidence for the full list with editorial commentary on each.
What are the best alternatives to OpenCTI?
Top OpenCTI alternatives in Analytics are ranked by recent ship velocity. Browse the "OpenCTI alternatives" section above for the current picks, or visit /alternatives/opencti for the full list with editorial commentary on each.