IntelOwl: Making the Life of Security Analysts Easier

### Overview In this talk, Matteo and Simone from Certego and The Honeynet Project introduce IntelOwl, an open-source threat intelligence and data enrichment platform designed to alleviate burnout and repetitive toil for cybersecurity analysts. Motivated by personal experiences with alert fatigue, extreme stress, and manual copy-pasting across disparate threat intelligence tools in 2017, the creators started building IntelOwl in early 2020. The platform automates the acquisition and aggregation of threat intelligence context for artifacts such as URLs, domains, IP addresses, hashes, and files via a graphical web interface or an API.

### Key Topics - **Analyst Burnout and Bottlenecks**: High alert volumes, skill shortages, on-call burdens, and manual multi-source threat intelligence gathering contribute significantly to analyst fatigue. Automating data enrichment directly reduces investigation and alert triage times. - **Architecture and Component Ecosystem**: IntelOwl is structured as both a platform and an extensible framework. Its modular plugin architecture consists of analyzers (which query internal and external intelligence sources), connectors (which push generated intelligence into external tools such as MISP), visualizers (which render raw JSON output into human-readable visual summaries), and playbooks (reusable collections or aliases of analyzers and plugins grouped for specific workflows like static file analysis or phishing). - **Pivot Investigations**: Introduced around release 6.0, IntelOwl transitioned from individual, single-shot job analysis to multi-step investigation workflows. Analysts can pivot directly from one artifact's results (e.g., resolving a domain to an IP address) into subsequent scans, linking findings into cohesive investigations or automated sequences such as automated abuse-takedown requests.

### Technical Details - **Backend & Frontend**: The backend is built using Python, Django, Celery for asynchronous background task execution, and uses Nginx as a reverse proxy alongside WSGI and ASGI (Daphne) containers to handle standard web traffic and WebSockets. The user interface is developed in ReactJS. - **Data Stores and Brokers**: IntelOwl relies on PostgreSQL as its primary database, with optional secondary integration with Elasticsearch for business and analytic data. Supported Celery message brokers include Redis (the default), RabbitMQ, and AWS SQS. - **Deployment and Interfaces**: The infrastructure is containerized using Docker and Docker Compose. Interactions can be conducted through the React web UI, a dedicated Python SDK, or standard REST APIs. - **Community and Extensibility**: The project has grown through programs like Google Summer of Code (GSoC) and community-authored analyzers. In addition to manual pivots, workflows can chain analyzer findings to connectors, as demonstrated in an automated abuse takedown playbook that queries domain DNS, extracts abuse contact emails, and dispatches a takedown notice.

### Takeaways IntelOwl enables security teams to automate the routine ingestion of threat data across commercial, internal, and open-source intelligence sources with a single click or API call. The project continues to evolve from an artifact enrichment engine into a collaborative investigation workbench, with planned enhancements including deeper open-source tool integrations, shared analyst workspaces, and LLM-powered chatbot assistants.