IntelOwl
Operator: Certego S.R.L., Italy
Self-hosted analysis platform that examines IP addresses, domains, URLs, file hashes and documents using multiple services.
Technical Infrastructure
Product
Free open-source platform for enriching threat intelligence. Self-hosted installation with a web interface, REST API and optional local AI assistant.
Availability and source date
Active
As of: 16 October 2026.
No functionality test has been performed.
Use in OSINT research
Combines information from multiple threat intelligence services for an indicator and analyses documents using local tools. Retains results and relationships within an instance.
Queries
| Input | Result | Result type |
|---|---|---|
| IP address | Depending on the enabled module, AbuseIPDB reports, abuse contacts or information from other threat intelligence services. | Retrieved |
| Domain / website + URL | Depending on the module, existing threat intelligence, WHOIS information or DNS and web analysis. | Retrieved |
| File hash | Existing file and malware reports from connected services such as VirusTotal or YARAify. | Retrieved |
| Document / file | Metadata, macros and indicators from local static analysis, for example of PDF and Office files. | Technical check according to provider |
| Email address | Depending on the configured module, reputation information from EmailRep or known data breaches from Have I Been Pwned. | Retrieved |
Features
- Queries multiple threat intelligence services through a shared analysis job.
- Analyses PDF and Office files and other file types using local tools.
- Links analyses in investigations and reusable playbooks.
- Exports results through connectors, for example to MISP or OpenCTI.
- Offers its own REST API and official Python and Go clients.
- Optionally summarises results using a local Ollama assistant.
Categories
- Technical Infrastructure
- Threat intelligence
Coverage
Dataset
Results from enabled local analysis tools and external threat intelligence services. No predefined regional database.
Access
Installation and deployment
Locally installable · Self-hosted
Self-hosted web platform with Docker Compose. Ubuntu/Debian is recommended. Optional Ollama service for the local AI assistant; API clients also run locally.
Requirements
Your own Docker installation and an account in the instance. API access uses a token; some external analysis providers require additional keys. Ollama is optional for the AI assistant.
Export
JSON results through the API; connectors to services including MISP and OpenCTI.
Provider
Certego S.R.L.
Country of establishment
Italy
Interfaces
API
Available. The instance's own REST API with token authentication. Third-party provider APIs are also accessed through analysis modules.
MCP
Not documented. No MCP server is described in the README, API, chatbot and installation materials reviewed.
AI agents
Available. Optional local Ollama agent from version 6.7.0. Calls IntelOwl tools and answers questions about analyses. This does not promise an external agent interface.
Maintenance
Licence
AGPL-3.0
Latest activity
Commit 09/2026
Stars
approx. 4,800 (as of 16 October 2026)
Legal note
Limitations
- Results and coverage depend on the enabled analysis modules and their data sources. External services may require their own keys and paid plans.
- Files or indicators may be sent to external services, depending on the module.
- For release v6.8.0, the project states that its Docker builds lack ARM support.
Guides and practical reports
Official · IntelOwl Installation
IntelOwl Project · EN
Explains Docker installation, configuration, user accounts and optional services.