IntelOwl

IntelOwl is an open-source threat intelligence management platform that aggregates and correlates data from over 100 external analyzers, scanners, and enrichment services. Feed it an observable — IP address, domain, URL, file hash, or email — and IntelOwl automatically queries VirusTotal, AbuseIPDB, Shodan, URLhaus, MalwareBazaar, MISP feeds, and dozens of other sources in parallel, returning a unified report with cross-referenced findings. The platform supports both automatic triage workflows and manual analyst-driven investigations. IntelOwl integrates with MISP and OpenCTI for bidirectional threat intel sharing, and its playbook system allows you to define custom analysis chains for different observable types. The Docker-based deployment includes a web UI, REST API, and Celery task queue for handling high-volume enrichment. With over 4,500 GitHub stars, IntelOwl has become a popular alternative to commercial TIP platforms like ThreatConnect and Anomali.