← Back to home
Comparison · Analytics

OpenCTI vs OpenReplay

A side-by-side editorial comparison of OpenCTI and OpenReplay — release velocity, themes, recent moves, and the top alternatives to consider.

OpenCTI vs OpenReplay: at a glance

FeatureOpenCTIOpenReplay
SectorAnalyticsAnalytics
Velocity score5.05.0
Sparks · 30d00
Top themesthreat-intelligence, licensing, access-control, custom-viewssession replay, self-hosted, security hardening, backports
Last editorial update14h ago10h ago
WebsiteVisit →Visit →

What is OpenCTI?

OpenCTI accepts Filigran licenses and closes a draft-access hole in its TAXII routes.

OpenCTI keeps a release every few days. 7.261103.0 lets a Filigran license be installed as the platform license, validates draft context on TAXII and HTTP routes so users can't reach drafts they shouldn't, and harmonizes redirects across authentication endpoints. It also fixes a regression that left the Prometheus exporter listening only on localhost. The prior release added Hub import to custom views and configuration-bundle export.

Read the full OpenCTI trajectory →

What is OpenReplay?

OpenReplay lets self-hosters block the hosts a recorded session can make its asset cacher fetch.

OpenReplay's feed is still backend maintenance across the 1.25 to 1.27 lines. On Nov 3 it added ASSETS_DENY_HOSTS so the asset cacher refuses chosen hosts before any DNS lookup, after a probe session crash-looped a pod. The same day brought a fix for EE 1.26 images that crashed on start and a product-analytics user fix backported to three lines.

Read the full OpenReplay trajectory →

OpenCTI vs OpenReplay: editorial side-by-side

O
OpenCTI
ANALYTICS
5.0

OpenCTI accepts Filigran licenses and closes a draft-access hole in its TAXII routes.

◆ Current state

OpenCTI keeps a release every few days. 7.261103.0 lets a Filigran license be installed as the platform license, validates draft context on TAXII and HTTP routes so users can't reach drafts they shouldn't, and harmonizes redirects across authentication endpoints. It also fixes a regression that left the Prometheus exporter listening only on localhost. The prior release added Hub import to custom views and configuration-bundle export.

◆ Where it's heading

After two weeks spent on dashboards and the knowledge graph, attention is turning to platform administration: configuration presets, Hub-distributed views, connector forms and ingestion health, which is being built behind a feature flag. Custom fields now sit on the Enterprise side of the line, so new data-model flexibility is being used as a paid differentiator. Access-control fixes keep appearing, which suggests organization segregation is still being hardened.

◆ Prediction

Expect ingestion health to leave its feature flag in a coming weekly, with email notifications already in place. The entries do not indicate when a new LTS line will be cut.

O
OpenReplay
ANALYTICS
5.0

OpenReplay lets self-hosters block the hosts a recorded session can make its asset cacher fetch.

◆ Current state

OpenReplay's feed is still backend maintenance across the 1.25 to 1.27 lines. On Nov 3 it added ASSETS_DENY_HOSTS so the asset cacher refuses chosen hosts before any DNS lookup, after a probe session crash-looped a pod. The same day brought a fix for EE 1.26 images that crashed on start and a product-analytics user fix backported to three lines.

◆ Where it's heading

The work is hardening the self-hosted stack: safer asset fetching, startup crash fixes and the same patch landing on several release lines. The deny list moving into a shared package suggests asset handling is being made consistent across versions. No new user-facing features have appeared in recent entries.

◆ Prediction

Expect ASSETS_DENY_HOSTS to reach the 1.25 line next, following the usual backport pattern.

Alternatives to OpenCTI and OpenReplay

Other Analytics products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either OpenCTI or OpenReplay.

See all OpenCTI alternatives → · See all OpenReplay alternatives →

Recent activity from OpenCTI and OpenReplay

Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.

  1. 23h agoOpenReplay1.26: deny list for hosts the asset cacher may fetch
  2. 1d agoOpenReplay1.26 EE: fix startup crash from a removed SCIM import
  3. 1d agoOpenReplay1.26: assets Helm chart version bump
  4. 1d agoOpenReplay1.26: create analytics user when tracker.start() gets a userID
  5. 1d agoOpenCTIOpenCTI 7.261103.0: Filigran license install, draft access checks
  6. 1d agoOpenReplay1.27: asset cacher can reject a deny list of hosts
  7. 1d agoOpenReplay1.25: create analytics user when tracker.start() gets a userID
  8. 5d agoOpenCTIOpenCTI 7.261030.1: indicator lifecycle kept on low-confidence upsert
  9. 5d agoOpenCTIOpenCTI 7.261030.0: Hub import for views, manual coverage updates
  10. 9d agoOpenCTIOpenCTI 7.261026.0: bulk-update and dashboard access fixes
  11. 12d agoOpenCTIOpenCTI 7.261023.1: saved-filter switching fix
  12. 12d agoOpenCTIOpenCTI 7.261023.0: keyboard graph control, grouping, SVG export

Frequently asked questions

What is the difference between OpenCTI and OpenReplay?

They serve adjacent needs but don't currently overlap on shipped themes. OpenCTI and OpenReplay are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.

Is OpenCTI better than OpenReplay?

Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. OpenCTI and OpenReplay are shipping at a similar cadence (velocity 5.0 vs 5.0, both within Sparkpulse's "active" band). For your specific use case, the alternatives sections above list other Analytics products to evaluate alongside.

What are the best alternatives to OpenCTI?

Top OpenCTI alternatives in Analytics are ranked by recent ship velocity. Browse the "OpenCTI alternatives" section above for the current picks, or visit /alternatives/opencti for the full list with editorial commentary on each.

What are the best alternatives to OpenReplay?

Top OpenReplay alternatives in Analytics are ranked by recent ship velocity. Browse the "OpenReplay alternatives" section above for the current picks, or visit /alternatives/openreplay for the full list with editorial commentary on each.