intelowlproject/IntelOwl

Health v2 · maintenance only

Adoption not part of the score

4683 stars · 662 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

IntelOwl is an open-source, self-hosted application for managing threat intelligence at scale, querying many online analyzers and malware analysis tools about files, IPs, and domains via a single API request. It ships with a React GUI, a modular plugin framework of 200+ analyzers, and official client libraries for automation.

Use cases

• enrich an IP address, domain, or file hash with threat intel from multiple sources in one request
• analyze suspicious malware samples with integrated analysis tools
• automate IOC enrichment in a SOC or incident response workflow
• hunt threats by querying observables at scale from a single API
• self-host a threat intelligence platform with a customizable analyzer plugin framework

When to choose

• you need a single API to fan out observable/file analysis across many OSINT and threat intel services
• you run SOC, DFIR, or threat hunting operations and want to automate enrichment
• you want a self-hosted, extensible platform with a GUI and plugin system

When to avoid

• you need a lightweight CLI-only enrichment script without hosting a full application
• you cannot self-host or comply with the AGPL-3.0 license
• you need a commercial feed aggregator rather than an analysis orchestration platform

Facets

application · maturity active

security osint api-framework web-framework plugin-system search-engine security osint developer-tools apis self-hosted python threat-intelligence ioc-enrichment malware-analysis incident-response dfir soc-operations threat-hunting observables automation docker web-server linux

Member repositories

For agents

markdown · JSON · MCP: product_card(name="intelowlproject/IntelOwl")