intelowlproject/IntelOwl

Features

• Analysis Playbooks - Defines reusable sequences of analysis tasks that trigger subsequent jobs based on the output of previous steps.
• Security Operations Automation - Implements a workflow engine that executes repeatable playbooks to automate manual security operations center tasks.
• External Intelligence Integrators - Coordinates requests across a variety of internal tools and external APIs to enrich security observables.
• Analysis Workflow Chaining - Triggers subsequent analysis jobs based on the results of previous tasks to automate complex investigation paths.
• Security Automation Workflows - Executes repeatable playbooks and integrates libraries to replace manual security analyst tasks with automated processes.
• Security Workflow Automators - Replaces manual security analyst tasks with repeatable playbooks and automated workflows to process threat observables.
• Intelligence Enrichment - Aggregates data for malware and observables from multiple external and internal sources to increase context.
• Incident Investigation Tools - Provides a workspace for grouping related analysis jobs and notes to identify security threats and correlate data.
• Investigation Case Management - Groups related analysis jobs and notes into a single entity to track findings and correlate information.
• Observable Analyzers - Extracts intelligence from files, IPs, and domains using static analysis and external API integrations.
• Threat Intelligence Aggregation - Aggregates data on malware, IPs, and domains from multiple external analyzers via a single request to unify security research.
• Threat Observable Analysis - Extracts intelligence from files and network indicators using static analysis tools and external API integrations.
• Threat Intelligence Management - Organizes security investigations and tracks analyzed artifacts to correlate findings across diverse threat reports.
• Threat Intelligence Platforms - Functions as a centralized system for aggregating, analyzing, and enriching security observables from internal and external sources.
• Analysis Tool Grouping - Saves combinations of analyzers and connectors as reusable playbooks to standardize recurring investigation tasks.
• Technical Indicator Tracking - Maintains unique entities for observables to link multiple analysis jobs and metadata to a single artifact.
• Investigation Dashboards - Renders threat data through dashboards and visualizers to correlate findings and track investigation progress.
• Indicator Feed Ingestion - Automatically triggers analysis playbooks when new observables are imported from external threat streams.
• Stream Ingestion - Imports streams of observables or files automatically for immediate processing and analysis.
• Observable Artifact Tracking - Maintains unique objects for observables to link multiple analysis jobs to a single file or indicator.
• Data Privacy Controls - Controls the execution of analyzers and connectors based on protocol levels to prevent sensitive data leakage.
• Analyzer Access Controls - Restricts the execution of specific analyzers and connectors based on data sensitivity levels to prevent information leakage.
• Reliability Scoring - Combines analyzer data models with user reports to produce reliability and evaluation scores for observables.
• Schema-Based Aggregation - Unifies diverse security data from multiple external analyzers into a common data model for consistent evaluation.
• Threat Intelligence - Scalable management of threat intelligence data.
• Detection and Hunting Tools - OSINT solution for gathering threat intelligence at scale.
• Open Source Intelligence - Analyzes files and domains using multiple intelligence sources.
• Threat Intelligence - Automated OSINT analysis for files, IPs, and domains.

Star history