Glances
Glances 4.5.9 closes out the 4.x line as a 5.0 beta opens for testing.
Comparison · Analytics
NetObserv vs OpenCTI
A side-by-side editorial comparison of NetObserv and OpenCTI — release velocity, themes, recent moves, and the top alternatives to consider.
NetObserv vs OpenCTI: at a glance
What is NetObserv?
NetObserv hit 2.0 without breaking changes, then started renaming its metrics.
NetObserv's operator reached 2.0.0 in September, labelled entirely non-breaking: BGP ASN enrichment through FRRConfiguration CRDs, DNS names in metrics, DNS port configuration in the FlowCollector API, stricter RBAC and network policies for the operator itself, and TLS settings taken from the OpenShift API server. 2.0.1 was fixes and dependency bumps. 2.0.2 fixes ASN labels and IPSec metrics, captures OpenSSL socket tuples at event time in the eBPF agent, and renames filtered_flows_total to filtered_packets_total.
What is OpenCTI?
OpenCTI adds custom fields to cases and backports its draft-access fix to both LTS lines.
OpenCTI 7.261106.0 adds custom fields and templates to Cases and Incidents, a configurable de-duplication window for sightings, blog post items and form intake for view-only users, plus Elasticsearch query speedups. The same week, LTS 7.260811.0-lts.2 and 7.260309.0-lts.9 backport the security fixes from the main line: draft-context checks on TAXII and HTTP routes, a timeout for JSONPath ingestion scripts and a size cap on artifact imports.
NetObserv vs OpenCTI: editorial side-by-side
NetObserv
2.5ANALYTICS
NetObserv hit 2.0 without breaking changes, then started renaming its metrics.
◆ Current state
NetObserv's operator reached 2.0.0 in September, labelled entirely non-breaking: BGP ASN enrichment through FRRConfiguration CRDs, DNS names in metrics, DNS port configuration in the FlowCollector API, stricter RBAC and network policies for the operator itself, and TLS settings taken from the OpenShift API server. 2.0.1 was fixes and dependency bumps. 2.0.2 fixes ASN labels and IPSec metrics, captures OpenSSL socket tuples at event time in the eBPF agent, and renames filtered_flows_total to filtered_packets_total.
◆ Where it's heading
The 2.0 line adds routing context (BGP ASNs) and DNS identity to flows, which moves the tool from 'which pod talked to which' toward 'which network and service.' The operator's own security posture, with RBAC, network policies and TLS profiles, is getting as much attention as the data. The TLS thread continues inside the eBPF agent, with OpenSSL tracking narrowed to packet mode in 2.0.2.
◆ Prediction
Expect 2.0.x fixes around the new ASN and TLS enrichment, which both needed corrections in 2.0.2. The metric rename is a signal that dashboards built on older names may need updating in later releases too.
OpenCTI
5.0ANALYTICS
OpenCTI adds custom fields to cases and backports its draft-access fix to both LTS lines.
◆ Current state
OpenCTI 7.261106.0 adds custom fields and templates to Cases and Incidents, a configurable de-duplication window for sightings, blog post items and form intake for view-only users, plus Elasticsearch query speedups. The same week, LTS 7.260811.0-lts.2 and 7.260309.0-lts.9 backport the security fixes from the main line: draft-context checks on TAXII and HTTP routes, a timeout for JSONPath ingestion scripts and a size cap on artifact imports.
◆ Where it's heading
The main line keeps adding analyst and case-management features every few days, while two LTS lines get the security fixes. Case management is gaining configurability, after custom views and Hub imports in late October.
◆ Prediction
Expect further case and incident customization in the next main releases and another LTS round when security fixes land.
Alternatives to NetObserv and OpenCTI
Other Analytics products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either NetObserv or OpenCTI.
Calibre
Calibre MCP lets your coding agent read RUM and Lighthouse data, then fix the slow code
Dovetail
Dovetail opens its docs to Claude and ChatGPT as co-authors.
Apache SkyWalking
SkyWalking 11.1 builds service maps from OpenTelemetry traces, no SkyWalking agent required.
OpenReplay
OpenReplay's feed is Helm chart bumps behind its asset-cacher deny list.
Tinybird
Tinybird shrinks its Local image by a third after a run of observability updates.
See all NetObserv alternatives → · See all OpenCTI alternatives →
Recent activity from NetObserv and OpenCTI
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 3d agoOpenCTIOpenCTI 7.261106.0: custom fields and templates for cases
- 3d agoOpenCTIOpenCTI LTS 7.260811.0-lts.2 backports draft-access fix
- 3d agoOpenCTIOpenCTI LTS 7.260309.0-lts.9 backports draft-access fix
- 6d agoOpenCTIOpenCTI 7.261103.0: Filigran license install, draft access checks
- 10d agoOpenCTIOpenCTI 7.261030.1: indicator lifecycle kept on low-confidence upsert
- 10d agoOpenCTIOpenCTI 7.261030.0: Hub import for views, manual coverage updates
- 11d agoNetObserv2.0.2 fixes ASN enrichment and renames a flow metric
- 1mo agoNetObserv2.0.1 adjusts DNS port defaults and bumps dependencies
- 1mo agoNetObserv2.0.0 adds BGP ASN enrichment and stricter operator RBAC
- 3mo agoNetObserv1.12.0 adds TLS alerting, flp-informers and signed releases
- 4mo agoNetObserv1.11.5 adds TLS metrics, Kafka compression and drop events
- 7mo agoNetObservTLS tracking arrives as a feature knob with new TLS fields ⚡
Frequently asked questions
What is the difference between NetObserv and OpenCTI?
They serve adjacent needs but don't currently overlap on shipped themes. OpenCTI is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is NetObserv better than OpenCTI?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. OpenCTI is currently shipping more aggressively (velocity 5.0 vs 2.5), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Analytics products to evaluate alongside.
What are the best alternatives to NetObserv?
Top NetObserv alternatives in Analytics are ranked by recent ship velocity. Browse the "NetObserv alternatives" section above for the current picks, or visit /alternatives/netobserv for the full list with editorial commentary on each.
What are the best alternatives to OpenCTI?
Top OpenCTI alternatives in Analytics are ranked by recent ship velocity. Browse the "OpenCTI alternatives" section above for the current picks, or visit /alternatives/opencti for the full list with editorial commentary on each.