$ show intelowlproject/IntelOwl
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
The LLM identified 4 files worth highlighting for reuse:
Implements a `merge()` method on the data model queryset that uses PostgreSQL window functions and conditional aggregation to combine per-analyzer data model evaluations into a single job-level data model. This is a non-obvious SQL optimization pattern that avoids N+1 queries and can be extracted for any Django project needing to merge related model data with priority logic.
Provides a `decay()` method that bulk-updates user event reliability scores using configurable decay functions (linear and inverse exponential). This is a self-contained data quality pattern for gradually reducing the influence of stale user feedback, easily reusable in any system with time-decaying user ratings or threat intelligence scores.
A deterministic backstop that detects when the LLM fabricates bracketed placeholder names (e.g., `[Playbook X]`) and appends a warning to the response. This is a small, self-contained module that can be reused in any LLM application to mitigate hallucination of non-existent entities, demonstrating a practical safety pattern beyond probabilistic prompt engineering.
The base React component for a declarative visualizer framework that renders analysis reports as composable UI elements (tables, lists, images, downloads). It provides a clean interface for tooltips, copy-to-clipboard, links, and pivot actions. This component is self-contained and can be extracted as a reusable library for rendering structured data in any React application.