> ## Content Index
> Fetch the complete content index at: https://darkwebinformer.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# IntelOwl: Manage Your Threat Intelligence at Scale
- URL: https://darkwebinformer.com/intelowl-manage-your-threat-intelligence-at-scale/
- Published: 2024-08-28T15:33:02.000Z
- Updated: 2025-09-04T22:27:08.000Z
- Author: Dark Web Informer
- Tags: OSINT, Tools

Direct Link: <https://github.com/intelowlproject/IntelOwl/>  
Last Commit: August 28th, 2024

# Intel Owl

[](https://github.com/intelowlproject/IntelOwl/#intel-owl)

Do you want to get **threat intelligence data** about a malware, an IP address or a domain? Do you want to get this kind of data from multiple sources at the same time using **a single API request**?

You are in the right place!

IntelOwl is an Open Source solution for management of Threat Intelligence at scale. It integrates a number of analyzers available online and a lot of cutting-edge malware analysis tools.

### Features

[](https://github.com/intelowlproject/IntelOwl/#features)

This application is built to **scale out** and to **speed up the retrieval of threat info**.

It provides:

- **Enrichment of Threat Intel** for files as well as observables (IP, Domain, URL, hash, etc).
- A Fully-fledged REST APIs written in Django and Python.
- An easy way to be integrated in your stack of security tools to automate common jobs usually performed, for instance, by SOC analysts manually. (Thanks to the official libraries [pyintelowl](https://github.com/intelowlproject/pyintelowl) and [go-intelowl](https://github.com/intelowlproject/go-intelowl))
- A **built-in GUI**: provides features such as dashboard, visualizations of analysis data, easy to use forms for requesting new analysis, etc.
- A **framework** composed of modular components called **Plugins**:
  - *analyzers* that can be run to either retrieve data from external sources (like VirusTotal or AbuseIPDB) or to generate intel from internally available tools (like Yara or Oletools)
  - *connectors* that can be run to export data to external platforms (like MISP or OpenCTI)
  - *pivots* that are designed to trigger the execution of a chain of analysis and connect them to each other
  - *visualizers* that are designed to create custom visualizations of analyzers results
  - *ingestors* that allows to automatically ingest stream of observables or files to IntelOwl itself
  - *playbooks* that are meant to make analysis easily repeatable

### Documentation

[](https://github.com/intelowlproject/IntelOwl/#documentation)

We try hard to keep our documentation well written, easy to understand and always updated. All info about installation, usage, configuration and contribution can be found [here](https://intelowlproject.github.io/docs/)

### Publications and Media

[](https://github.com/intelowlproject/IntelOwl/#publications-and-media)

To know more about the project and its growth over time, you may be interested in reading [the official blog posts and/or videos about the project by clicking on this link](https://intelowlproject.github.io/docs/IntelOwl/introduction/#publications-and-media)

### Available services or analyzers

[](https://github.com/intelowlproject/IntelOwl/#available-services-or-analyzers)

You can see the full list of all available analyzers in the [documentation](https://intelowlproject.github.io/docs/IntelOwl/usage/#analyzers).

| Type              | Analyzers Available                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
| ----------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| Inbuilt modules   | \- Static Office Document, RTF, PDF, PE File Analysis and metadata extraction\- Strings Deobfuscation and analysis ([FLOSS](https://github.com/mandiant/flare-floss), [Stringsifter](https://github.com/mandiant/stringsifter), ...)\- PE Emulation with [Qiling](https://github.com/qilingframework/qiling) and [Speakeasy](https://github.com/mandiant/speakeasy)\- PE Signature verification\- PE Capabilities Extraction ([CAPA](https://github.com/mandiant/capa))\- Javascript Emulation ([Box-js](https://github.com/CapacitorSet/box-js))\- Android Malware Analysis ([Quark-Engine](https://github.com/quark-engine/quark-engine), ...)\- SPF and DMARC Validator\- Yara (a lot of public rules are available. You can also add your own rules)\- more... |
| External services | \- Abuse.ch [MalwareBazaar](https://bazaar.abuse.ch/about/)/[URLhaus](https://urlhaus.abuse.ch/)/[Threatfox](https://threatfox.abuse.ch/about/)/[YARAify](https://yaraify.abuse.ch/about/)\- [GreyNoise v2](https://docs.greynoise.io/docs/3rd-party-integrations)\- [Intezer](https://analyze.intezer.com/?utm%5Fsource=IntelOwl)\- VirusTotal v3\- [Crowdsec](https://doc.crowdsec.net/docs/next/cti%5Fapi/integration%5Fintelowl/?utm%5Fsource=IntelOwl)\- [URLscan](https://urlscan.io/docs/integrations/)\- Shodan\- AlienVault OTX\- [Intelligence\_X](https://intelx.io/integrations)\- [MISP](https://www.misp-project.org/)\- many more..                                                                                                                 |

## About the author and maintainers

[](https://github.com/intelowlproject/IntelOwl/#about-the-author-and-maintainers)

Feel free to contact the main developers at any time on Twitter:

- [Matteo Lodi](https://twitter.com/matte%5Flodi): Author and principal maintainer
- [Simone Berni](https://twitter.com/0ssig3no): Backend Maintainer
- [Daniele Rosetti](https://github.com/drosetti): Frontend Maintainer
- [Eshaan Bansal](https://twitter.com/eshaan7%5F): Key Contributor

### Consultancy

[](https://github.com/intelowlproject/IntelOwl/#consultancy)

IntelOwl's maintainers are available to offer [paid consultancy and mentorship](https://opencollective.com/intelowl-project).