IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
Yeti is a threat intelligence platform that ingests, enriches, correlates, and stores cyber threat observables, entities, indicators (YARA, Sigma, Suricata, regex, forensic artifacts), and DFIQ investigative questions. It provides a FastAPI-based REST API for CRUD operations, graph traversal, semantic search (via ChromaDB), and RBAC. The system uses ArangoDB as its primary graph/document database, Redis for message brokering, and Celery for background task scheduling. It includes a plugin architecture for feeds (30+ public sources like MITRE ATT&CK, CISA KEV, MISP, AbuseIPDB) and analytics (Shodan, Censys, VirusTotal, etc.). The codebase is well-structured with clean abstractions (ArangoYetiConnector, event system, polymorphic schemas, migration framework) but contains deprecated plugins and some configuration drift. It is primarily an application, not a data research project.
This is an R/Bioconductor package for making enriched heatmaps, primarily used in epigenomics to visualize enrichment of genomic signals (e.g., histone modifications, DNA methylation) around target regions (e.g., transcription start sites). The package provides a workflow: normalize signals to a matrix via `normalizeToMatrix()`, then draw a heatmap with `EnrichedHeatmap()`, which is a subclass of ComplexHeatmap. It includes specialized annotation (`anno_enriched()`), row ordering by enrichment scores, smoothing, and support for categorical signals. The architecture leverages S3 classes (normalizedMatrix) and integrates with GenomicRanges for genomic interval operations. It is well-documented with vignettes and a pkgdown site, and includes Rcpp for performance-critical distance calculations. While the package is actively maintained, there are some signs of technical drift such as deprecated arguments and an old CI configuration.