Research cutoff: 2026-09-10. Data comes from a six domains + general substrate scan (8 candidates + 3 deep-dives per domain), Grok three-vote adversarial verification reports (three independent models cross-checked), independent fact-checking, and a gap-filling checklist. All numbers are sourced from the above data; items that could not be independently verified are explicitly marked. Target reader: individual developers / small teams looking for an open-source platform chassis that can handle multiple scenarios.

Disclaimer: This is technical research, not legal advice; tools involving data collection (e.g., MediaCrawler) require your own compliance review (platform ToS, Personal Information Protection Law, etc.) before use.

TL;DR (Three-Sentence Verdict)

1. No ready-made “six-in-one” platform exists. As of September 2026, no single open-source platform covers the majority of scenarios across cybersecurity, risk control, supply chain, public opinion monitoring, finance, and industrial monitoring; the platform-level projects that passed adversarial verification (Wazuh, StreamPipes, OpenAEV) are all strictly single-domain.
2. The most realistic route is to self-build with a “general-purpose chassis + domain tools as plugins”: for individuals/small teams, the recommendation is Kestra for orchestration, PostgreSQL for storage, 夜莺 Nightingale (a Chinese-community-led alerting engine) or Grafana for alerting and visualization, then plug in domain champions like TrendRadar, MediaCrawler, OpenBB, and Grype as “data-source plugins” — rather than stripping and repurposing a domain platform like OpenCTI, which would be a rewrite-level engineering effort.
3. The biggest pitfall in selection is licensing, not functionality. Only Apache-2.0 / MIT-family licenses (Kestra, ThingsBoard CE, Dependency-Track, 夜莺 Nightingale, etc.) can safely serve as the chassis for closed-source products; AGPL components like Grafana, MISP, and OpenObserve will “infect” your product with open-source obligations once embedded into something you sell externally — they must be deployed independently and integrated via loosely coupled APIs; ELv2 (Marble), SSPL, and custom protocols (MediaCrawler, Dify) each have their own landmines.

1. Cybersecurity / Threat Intelligence / OSINT

(Terms in plain English: IOC = “crime scene traces” left by attackers, such as malicious IPs, domains, file hashes; STIX 2.1 = the standard intelligence description format used in the threat intelligence community; OSINT = open-source intelligence, i.e., information gathered from public websites/APIs.)

How to choose. OpenCTI is the most platform-like in this domain: the most complete connector ecosystem (pulls from MISP/CVE/AlienVault/MITRE, pushes to Splunk/Elastic/QRadar), metadata and activity “verified” (9,916 stars, still pushing as of 2026-09-09; license is Filigran custom dual-license — GitHub API actually returns NOASSERTION/Other, not pure Apache-2.0, the original “Apache-2.0 community edition” claim has been corrected, must read the original LICENSE text before commercial use). But it is heavy to deploy (Elasticsearch + Redis + RabbitMQ + S3 four-piece stack), and its data model is deeply bound to STIX 2.1 — using it as a general-purpose chassis means rewriting the data layer and frontend. MISP has the largest community, but AGPL-3.0 means you can only deploy it independently and call it via API; embedding it into a commercial product is basically a non-starter, and it’s a LAMP legacy stack (PHP monolith) where the project itself admits to performance bottlenecks under large data volumes. SpiderFoot has the cleanest license (MIT), but maintenance has “verified” slowed — last push stopped at 2026-04-13, about 5 months with no activity, and the open-source version does not include continuous monitoring/alerting/multi-user (paid HX has these; author’s commercial boundary).

Gap-filling (not deep-dived): Wazuh — the de facto open-source XDR/SIEM standard (unified threat detection and log analysis platform), GPLv2, confirmed by three-vote verification as the security domain platform blueprint; Yeti (CTI+DFIR intelligence platform); OWASP Amass (attack surface mapping); Taranis AI (European CERT-system OSINT newcomer).

2. Enterprise Risk Control / Anti-Fraud / Risk Decision Engines

How to choose. This domain has no perfect answer; every option has a thorn. Marble is closest to a commercial SaaS experience (rules + scoring + list screening + case management + audit logs in one, Docker Compose one-click start), but the ELv2 license prohibits you from turning it into a managed service to sell, and enterprise features (RBAC/SSO) are locked behind the paid version. Tirreno has a clean architecture (event API → enrichment → rule engine calculates trust score → review queue), but AGPL-3.0 + no outbound alerting capability (no webhook/email/Slack) + open-sourced only in 2024-12 with few production cases. 天网 risk_engine is the lone survivor in the Chinese-speaking world: rulesets/decision trees/scorecards/champion-challenger all covered, Apache-2.0 use it freely, but “verified” it is essentially stalled — no feature iteration after 2024-02, only one typo fix merged in 2026, single-person project, no web console, no data connectors. If all you need is a rule engine chassis, Drools (Apache-2.0, 6,315 stars) has the thickest ecosystem, but it is only an engine not a platform — lists/features/cases must all be self-built.

Gap-filling (not deep-dived): OpenSanctions (open-source sanctions/PEP list database, AML screening chassis); URule (domestic Chinese rule engine, common in banking and internet finance); 陌陌 Aswan (LGPL-2.1, 3,047 stars, big-tech production-verified); Radar (SpringBoot-based domestic Chinese real-time risk control, abundant Chinese documentation but license undeclared).

3. Supply Chain Security and Vendor Risk

(Terms in plain English: SBOM = Software Bill of Materials, essentially a detailed list of which third-party components a piece of software uses; SCA = Software Composition Analysis, checking whether your dependencies have known vulnerabilities or license issues.)

How to choose. This is the most worry-free of the six domains: the top three are all Apache-2.0, free for commercial use. The division of labor is also clear — Syft generates the SBOM, Grype/OSV-Scanner scans for vulnerabilities, and results feed into Dependency-Track for continuous monitoring (policy engine + Email/Slack/Webhook notifications all included). Dependency-Track’s key facts “verified” (Apache-2.0, OWASP flagship, 4,191 stars, active as of 2026-09-09); the website’s claim of “over 20,000 organizations using it” could not be independently verified for the specific number, but the direction is credible. Two notes: v5 has switched to a Kafka distributed architecture (Hyades), a breaking change; v4.13 security support ended in March 2026, existing deployments must upgrade. Limitations are also obvious: it only covers the “software composition” dimension — traditional vendor risk (questionnaires, ratings, contracts) requires CISO Assistant (open-core GRC platform, 4,416 stars).

Gap-filling (not deep-dived): Trivy (de facto standard for cloud-native scanning); OpenSSF Scorecard (upstream project health scoring); Sigstore Cosign + in-toto (artifact signing and supply chain integrity); cdxgen (multi-language SBOM generation); GUAC (1,540 stars, the only platform capable of cross-metadata graph-based impact analysis).

4. Public Opinion Monitoring / Omni-Media Information Collection

How to choose. The three leaders in Chinese public opinion monitoring, with complementary division of labor: TrendRadar is the fastest to deploy — aggregates public hot lists from 35 platforms + RSS, keyword filtering, AI summaries, WeCom/Feishu/DingTalk/TG/email push all configured, Docker one-click start; the trade-off is that it only provides “hot-list snapshots” without comment-level and full-text collection, and the GitHub Actions deployment mode requires manual check-in every 7 days to renew. MediaCrawler has the deepest collection (Xiaohongshu/Douyin/Kuaishou/Bilibili/Weibo/Tieba/Zhihu — seven platforms, including second-level comments), metadata “verified” (64,716 stars, active as of 2026-08-14); but the custom license must be reviewed clause by clause before commercial use, and the author has commercial motivation for a paid Pro version; there is also a “disputed” point: deep-dive data claimed it includes FastAPI REST/WebSocket service, but verification found no evidence in the open-source version’s README and repository structure (suspected of mixing in Pro version features) — the open-source version’s main entry point is CLI. BettaFish 微舆 has the strongest analysis (five self-developed engines + multi-agent forum debate, produces HTML/PDF research reports), but “verified” it has no alerting/notification/scheduled dispatch subsystem whatsoever — the so-called “7x24 monitoring” actually means the crawler can keep running; the system itself is a one-shot session of “query → analyze → generate report.” The common pitfall for all three: login-state crawlers violate platform ToS, involve personal information with exposure under the Personal Information Protection Law (PIPL), and GPL/custom protocols cannot be embedded into closed-source products.

Gap-filling (not deep-dived): changedetection.io (de facto standard for web change monitoring); Huginn (classic self-hosted monitoring agent); WeWe-RSS (WeChat Official Account to RSS); DailyHotApi (domestic Chinese hot-list aggregation API); Firecrawl (AI-ready web scraping).

5. Financial Research / Quantitative Data Platforms

How to choose. This domain has the cleanest licenses (all MIT-family), but the positioning is completely different. OpenBB is a “data access layer”: a single provider plugin registry simultaneously generates a Python SDK, REST API, and MCP server (the standard protocol for AI agents to directly connect to financial data); the plugin mechanism itself is domain-agnostic and is the most “general-platform-like” asset in the entire project. But two points warrant caution: first, the license is “disputed” — the scan report claims GitHub API confirms MIT, but independent verification found the API actually returns NOASSERTION, with public records showing a transition from AGPL-3.0 to MIT in 2025; refer to the original LICENSE text in the repository when citing. Second, maintenance slowdown “verified” — last push stopped at 2026-07-30, commit volume for a 72.8k-star project plummeted in 2026, with company resources shifting toward the closed-source Workspace. Qlib is a research workbench, not a service (no REST API, no alerting, no web UI); A-shares are a first-class citizen scenario, suitable for the factor/model research layer. vnpy is the live-trading layer, with excellent Chinese documentation and community, but it is desktop-GUI-centric and requires self-modification for cloud deployment. For pure data fetching, use AkShare (MIT, 22.5k stars, 2000+ interfaces, no registration required).

Gap-filling (not deep-dived): Tushare (domestic Chinese financial data interface standard); ccxt (unified crypto exchange API); Freqtrade (crypto quantitative bot); TradingAgents (2025’s viral multi-agent LLM trading project).

6. Industrial Monitoring / IoT / SCADA

(Terms in plain English: SCADA = systems that monitor and control equipment in factories; HMI = Human-Machine Interface, those process diagrams and dashboards on workshop screens; Modbus/OPC-UA = the two most common communication protocols for industrial devices.)

How to choose. ThingsBoard has the highest degree of platformization, with “verified” information all solid (Apache-2.0 CE, 22,392 stars, push on 2026-09-09, transport layer MQTT/CoAP/HTTP/LwM2M + Kafka + visual rule engine); but be aware it is open-core — SCADA screens, scheduled reports, and white-labeling are all locked in the paid PE, and it only accepts “push-mode” data; industrial protocols require a separate IoT Gateway component. Node-RED is glue, not a platform: its protocol node ecosystem (Modbus/OPC-UA/S7/BACnet) is unmatched, but it is single-process with no clustering/HA/alerting engine, and scaling capability is left to commercial FlowFuse. FUXA is the only one of the three with built-in “draw HMI screens” capability, MIT license, Docker one-click start, suitable for directly serving as SCADA in small-scale scenarios. Additionally, Grafana (76,656 stars) scores highest in general-purpose chassis adaptability in this domain (9/10) — it is the de facto standard for display and alerting, but it is read-only and cannot replace SCADA for sending control commands.

Gap-filling (not deep-dived): EMQX (domestic Chinese MQTT broker de facto standard); Apache IoTDB / TDengine (domestic Chinese industrial time-series databases); Apache PLC4X (unified industrial protocol access); EdgeX Foundry (edge IoT platform); Malcolm (CISA-published ICS traffic analysis suite).

7. General-Purpose Platform Chassis (Data Integration + Alerting + Visualization)

How to choose. Grafana’s chassis adaptability (8/10) is in the highest tier among all candidates: plugin system (data source/panel/app three types) + built-in alerting engine (email/Slack/Webhook/DingTalk etc.) + config-as-code, all five key facts “verified.” Two thorns: AGPL-3.0 (changed from Apache-2.0 in 2021), which is infectious when embedded into closed-source SaaS; scheduled PDF reports are enterprise-edition exclusive. OpenObserve is a general-purpose data platform of “any JSON time-series data → Parquet columnar storage → SQL query + four types of alerting + visualization”; its data model is business-agnostic with very high versatility, and deployment barrier is extremely low (single binary scaling to TB level); but also AGPL, and enterprise necessities like RBAC/SSO are locked in the commercial version. Kestra is the licensing bright spot in this domain (Apache-2.0), with YAML declarative orchestration + event triggers, best suited as the scheduling hub for “collection → processing → alerting” pipelines. Dify (155,239 stars) is suitable for the AI analysis layer — its standalone Go plugin daemon + plugin marketplace is truly plugin-based, but its license is an Apache-derived custom version, requiring authorization purchase for multi-tenant SaaS commercial use; and it has no alerting engine, no time-series storage, and cannot serve as the main chassis. n8n (203.9k stars) has the largest integration scale, but its Sustainable Use License is fair-code and non-OSI, requiring evaluation for commercial embedding.

Gap-filling (not deep-dived): Apache Airflow / SeaTunnel (data orchestration and integration); Apache Superset / DataEase (BI visualization, the latter domestic Chinese); Prometheus Alertmanager (alert routing standard); 夜莺 Nightingale (Apache-2.0, 13.3k stars, Chinese-community-led alerting engine); HertzBeat (domestic Chinese Apache monitoring).

8. General-Purpose Platform Verdict: Unified Chassis + Domain Plugins — Does It Work?

Feasibility: Yes, and there are existing blueprints. Through three-vote adversarial verification, the open-source community has repeatedly implemented the “unified data chassis + domain plugins” paradigm, with two copyable pathways:

• Wazuh pathway (security domain): endpoint agent collection → management server rule-based analysis → Indexer storage and search → unified UI visualization and alerting. GPLv2.
• Apache StreamPipes pathway (industrial domain): protocol adapter plugin layer (OPC UA/S7/MQTT/Kafka) → stream processing (Kafka Streams/Siddhi) → time-series database (InfluxDB/IoTDB) → real-time dashboards. Apache-2.0, governance-neutral.

The key insight is: don’t strip-shell a domain platform. All domain champions deep-dived in this round (OpenCTI bound to STIX2, MISP bound to the IOC vocabulary, Qlib bound to the trading calendar, ThingsBoard bound to device twins) are “thick domain shell + thin generic core” — the stripping cost approaches a rewrite. The correct approach is the reverse: choose a domain-agnostic chassis and plug domain tools in as data sources/plugins. Filigran’s “same-vendor multi-platform family” (OpenCTI threat intelligence + OpenAEV adversarial verification, note OpenBAS has been renamed OpenAEV, its license is identified by GitHub as Other — must be manually checked before commercial use) proves the organizational form of “one set of chassis organizational patterns + one product per domain” is viable — but it also proves this path has only been validated within the security domain so far.

Recommended Combo A: Lightweight Assembly Edition (Individuals/Small Teams, Can Be Running in 1-2 Weeks)

Recommended Combo B: Heavy Platform Edition (Small Teams Willing to Maintain Multiple Containers)

Use OpenObserve as the data lake + alerting core (any JSON pushed in, Parquet + S3 columnar storage, four types of alerting: scheduled/real-time/composite/anomaly detection), with Grafana attached for visualization; domain sub-platforms deployed independently, aggregating only via API: OpenCTI (threat intelligence), Dependency-Track (supply chain), ThingsBoard CE (industrial). All AGPL components run as independent services with network-isolated calls, not embedded in your own code — this is the standard posture for peacefully coexisting with AGPL.

9. Pitfalls and Risks

9.1 License Traps (Ranked by Danger Level)

GPL-2.0/3.0 (TrendRadar, BettaFish, 思通舆情 (Sitong Public Opinion, a public opinion monitoring platform), Wazuh) sit in between: safe for internal use without distribution; embedding into distributable commercial software triggers copyleft.

9.2 Maintenance Stagnation Signals (Must Check Before Selection)

• SpiderFoot: last push 2026-04-13, about 5 months without update, 323 open issues; structural risk of individual author + commercial version HX priority (does not include continuous monitoring/alerting (paid-version feature)).
• 天网 risk_engine: “verified” no feature iteration after 2024-02, only one typo fix merged in 2026; single-person project, 0 open issues is not a quality signal but a sign of community coldness.
• OpenBB: “verified” last push 2026-07-30; 2026 commit volume plummeted to 29 (727 in 2025, 1610 in 2024), company resources shifted to closed-source Workspace.
• 思通舆情, ScadaBR, IOT-Tree-Server: low activity, only suitable for architectural reference.
• Reverse positive signals: Grafana, OpenObserve, Dependency-Track, ThingsBoard, Node-RED, OSV-Scanner, MISP, Qlib all had pushes in early September 2026 (most “verified”).

9.3 Chinese Language Support Status

• Native Chinese: 天网 (all-Chinese DSL documentation), TrendRadar, BettaFish, MediaCrawler, vnpy, 夜莺 Nightingale, DataEase, HertzBeat, IOT-Tree — documentation, community, and data sources all in Chinese.
• Moderate: Grafana (UI has community Chinese translations but incomplete), ThingsBoard (UI has a Chinese language pack), Node-RED (abundant tutorials in the domestic IoT community).
• Essentially no Chinese: OpenCTI, MISP, SpiderFoot, Marble, Tirreno, Dependency-Track, OpenObserve, OpenBB — documentation is all English, domestic deployment requires self-translation; data sources like NVD/GitHub Advisories require proxy for direct access in China.

Primary Sources

1. https://github.com/OpenCTI-Platform/opencti
2. https://github.com/MISP/MISP
3. https://github.com/smicallef/spiderfoot
4. https://github.com/wazuh/wazuh
5. https://github.com/apache/streampipes
6. https://github.com/checkmarble/marble
7. https://github.com/tirrenotechnologies/tirreno
8. https://github.com/skyhackvip/risk_engine
9. https://github.com/DependencyTrack/dependency-track
10. https://github.com/anchore/grype
11. https://github.com/google/osv-scanner
12. https://github.com/NanmiCoder/MediaCrawler
13. https://github.com/sansan0/TrendRadar
14. https://github.com/666ghj/BettaFish
15. https://github.com/OpenBB-finance/OpenBB
16. https://github.com/microsoft/qlib
17. https://github.com/vnpy/vnpy
18. https://github.com/thingsboard/thingsboard
19. https://github.com/grafana/grafana
20. https://antirez.com/news/151 (Redis returning to AGPLv3, first-hand statement; also reference https://www.elastic.co/blog/elasticsearch-is-open-source-again)