certtools/intelmq

Health v2 · maintenance only

Adoption not part of the score

1133 stars · 318 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

IntelMQ is an open-source solution for IT security teams (CERTs, CSIRTs, SOCs) for collecting and processing security feeds using a message queuing protocol. It provides a modular bot-based pipeline architecture for automated incident handling, threat intelligence processing, and situational awareness.

Use cases

• collect and process security feeds from multiple sources
• automate incident handling workflows for CERTs and CSIRTs
• parse and normalize threat intelligence data into a common format
• aggregate indicators of compromise (IOCs) from various feeds
• automate abuse notifications to network owners
• build situational awareness dashboards from security events
• integrate threat intelligence with MISP, CIF, and other tools
• store processed security events in databases like PostgreSQL or Elasticsearch

When to choose

• you are a CERT/CSIRT/SOC needing to automate incident handling
• you need to collect and normalize threat intelligence from many heterogeneous feeds
• you want a stream-oriented, stateless pipeline for processing large volumes of security events
• you need to integrate with MISP, n6, CIF, or other threat intelligence platforms
• you want a community-driven, open-source tool with a data harmonization ontology

When to avoid

• you need a manually curated indicator database with event correlation (use MISP instead)
• you need a simple single-feed parser without pipeline orchestration
• you require a fully managed SaaS solution rather than self-hosted infrastructure
• your team cannot maintain a Python-based botnet of processing bots

Facets

framework · maturity active

message-queue etl streaming workflow-automation security webhook api-framework security python self-hosted threat-intelligence ioc csirt cert soc incident-handling security-feeds abuse-handling misp-integration data-harmonization automation incident-response linux docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="certtools/intelmq")