Skip to content
SPECIFICTION
Get listed

IntelOwl

github.com

Free plan WebLinuxAPISelf-hosted
Visit github.com
Spec score 8.0 #5 of 32 in Threat Intelligence Platforms

What it is

IntelOwl is an open-source threat intelligence platform that enriches files and observables from multiple sources through a single API. It is intended for work such as threat hunting, security operations, incident response, threat intelligence, and vulnerability management. The built-in web interface provides dashboards, analysis visualizations, and forms for requesting analyses. A REST API and official Python and Go clients are also available, including command-line use. Its plugin framework includes analyzers, connectors, pivots, visualizers, ingestors, and playbooks. Listed integrations include VirusTotal, AbuseIPDB, YARA, Oletools, ClamAV, and URLscan; connectors can share results with MISP, OpenCTI, YETI, and Slack. Deployment uses Docker Compose, with Debian-based Linux distributions, especially Ubuntu, documented as supported environments. The deployment comprises a React frontend, Django backend, PostgreSQL, Redis, Celery, and Nginx. The installation guide recommends 2 CPUs, 4 GB RAM, and 20 GB disk for a basic VM, or 8 CPUs, 16 GB RAM, and 80 GB disk for intensive use. Per-plugin TLP settings control which analyzers and connectors can run; RED prevents use of external services.

Spec sheet

Purpose
IntelOwl is an open-source threat intelligence platform that enriches files and observables using multiple sources through a single API.Read 9 Oct 2026 · github.com
Deployment
Installation uses Docker Compose and the project documents Debian-based Linux distributions, especially Ubuntu, as supported environments.Read 9 Oct 2026 · intelowlproject.github.io
License
The GitHub repository identifies the project license as AGPL-3.0.Read 9 Oct 2026 · github.com
Analysis integrations
The project lists integrations with services and tools including VirusTotal, AbuseIPDB, YARA, Oletools, ClamAV, and URLscan.Read 9 Oct 2026 · github.com
API and clients
IntelOwl provides a REST API and official Python and Go clients, which can also be used from the command line.Read 9 Oct 2026 · intelowlproject.github.io
Architecture
The deployment includes a React frontend, Django backend, PostgreSQL database, Redis message broker, Celery task queue, and Nginx reverse proxy.Read 9 Oct 2026 · intelowlproject.github.io
Data sharing controls
Per-plugin maximum TLP settings govern which analyzers and connectors can run, and the documentation says RED prevents use of external services.Read 9 Oct 2026 · intelowlproject.github.io
Deployment sizing
The installation guide recommends 2 CPUs, 4 GB RAM, and 20 GB disk for a basic VM deployment, and 8 CPUs, 16 GB RAM, and 80 GB disk for intensive use.Read 9 Oct 2026 · intelowlproject.github.io
Maintainer
The project README says management of IntelOwl has been fully in Certego's hands since version 6.8.0.Read 9 Oct 2026 · github.com
Platform limits
The documentation says Windows may run IntelOwl but is not officially supported, and macOS requires upgrading its bundled Bash to a version newer than 4 to run the startup script.Read 9 Oct 2026 · intelowlproject.github.io
Plugin framework
Its customizable plugins include analyzers, connectors, pivots, visualizers, ingestors, and playbooks.Read 9 Oct 2026 · intelowlproject.github.io
Support and consultancy
The documentation says maintainers are available to offer paid consultancy and mentorship about deployments.Read 9 Oct 2026 · intelowlproject.github.io
Threat sharing
Pre-built connectors can send analysis results to MISP, OpenCTI, YETI, and Slack.Read 9 Oct 2026 · intelowlproject.github.io
Use cases
The project describes use cases including threat hunting, SOC operations, incident response, threat intelligence, and vulnerability management.Read 9 Oct 2026 · intelowlproject.github.io
Web interface
The built-in web interface includes dashboards, analysis visualizations, and forms for requesting analyses.Read 9 Oct 2026 · intelowlproject.github.io

Plans and prices

IntelOwl Free Open-source solution; self-hosted deployment Read 9 Oct 2026 · github.com

Every IntelOwl plan and price →

Strong points and limits

Strong points

  • Free, open-source self-hosted deployment
  • Web interface, REST API, and official clients
  • Plugin framework covers analysis and workflow roles
  • Connectors share results with threat platforms

Limits

  • Windows is not officially supported
  • macOS startup needs a newer Bash than bundled version 4
  • Deployment requires Docker Compose
  • Basic VM recommendation includes 20 GB disk

Who it suits

IntelOwl suits security teams seeking a self-hosted platform for enrichment and related analysis workflows. Its documented deployment and sizing guidance can help teams assess their Linux environment before installation.

Verdict

IntelOwl brings enrichment, analysis, and threat-sharing options into a self-hosted platform with both web and API access. Its documented Linux environments and resource recommendations are useful considerations before deployment.

Where Specifiction places it

Alternatives to IntelOwlAll alternatives →

MISP From €0.61/mo · Free plan 9.0 Visit