IntelOwl

No entries match these filters. Clear filters

1. v6.8.0 Aug 31, 2026 · issue 062

   IntelOwl v6.8.0 adds a CTIConnector base class, chatbot improvements with OLLAMA_KEEP_ALIVE support, and richer connector health-check UI messages.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.8.0 https://github.com/intelowlproject/IntelOwl.git
   # already have the repo? check out this version:
   $ git checkout v6.8.0

   └──▷ USE IT
   Keep the Ollama model loaded in VRAMVRAMMemory attached to a graphics processor. Models, intermediate calculations and caches must fit here or be moved to slower memory. between chatbot requests to avoid cold-start delays in high-frequency analysis workflows.
   .env copy

   OLLAMA_KEEP_ALIVE=30m

   • Introduces CTIConnector base class to standardize CTICTICyber Threat Intelligence: structured knowledge about adversaries — their tactics, infrastructure, and indicators — that tools consume to prioritize detections or enrich alerts with context. connectors and support data-model enrichment across connector implementations.
   • Chatbot now defaults analyze_observable to a curated playbook and enforces rejection of placeholder names, preventing accidental stub submissions.
   • Connector health-check methods now return a (status, message) tuple, and the UI surfaces the full error message when a health check fails.
   • Hardens chatbot jobs-vs-investigations routing and accepts null filter arguments, broadening the range of valid chatbot queries.

   4 details in Everything

2. docs update Aug 19, 2026 · issue 050

   IntelOwl 6.8.0 adds an optional self-hosted MISP instance deployable with a single --misp flag alongside IntelOwl.

   • Adds --misp flag to spin up a self-hosted MISP threat intelligence platform alongside IntelOwl via docker/misp.override.yml, starting three containers: misp-core (MISP web app at https://misp-core), misp-db (MariaDB 10.11), and misp-redis (Valkey/Redis-compatible cache).
   • Supports pushing IntelOwl analysis results into the local MISP instance and searching MISP for known IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. without a separate MISP deployment.
   • Configures the IntelOwl MISP connector/analyzer (via Django Admin or GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. plugin configuration) with url_key_name set to https://misp-core and api_key_name set to the default admin API key.
   • MISP credentials and tuning are controlled via docker/env_file_misp, with default admin email admin@admin.test, password admin, and API key mispdefaultintelowladminapikeychgme01234 (intended for development only).

   4 details in Everything

3. docs update Aug 19, 2026 · issue 050

   IntelOwl 6.8.0 adds optional self-hosted MISP deployment via --misp flag with full env-file configuration

   └──▷ TRY IT
   Stand up IntelOwl with a self-hosted MISP instance and expose the MISP web GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. on port 8443 for browser access.
   copy

   $ cp docker/env_file_misp_template docker/env_file_misp
   # Set BASE_URL=https://localhost:8443 and ADMIN_KEY to a 40-char key in docker/env_file_misp
   python3 start.py --misp --custom

   Expose the MISP web GUI by adding a port mapping to the misp-core service via the custom override file.
   docker/custom.override.yml copy

   services:
     misp-core:
       ports:
         - "8443:443"

   • Adds --misp flag to deploy a self-hosted MISP instance alongside the main IntelOwl stack (available from version 6.8.0).
   • Configures the bundled MISP instance via docker/env_file_misp, with a full template provided at docker/env_file_misp_template; key variables include ADMIN_EMAIL, ADMIN_PASSWORD, ADMIN_KEY (must be exactly 40 characters), ADMIN_ORG, BASE_URL, MYSQL_PASSWORD, and REDIS_PASSWORD.
   • Supports exposing the MISP web GUI by adding a port mapping for the misp-core service in docker/custom.override.yml (used with the --custom flag), e.g. mapping port 8443:443.
   • Supports adding the misp-modules enrichment service via docker/custom.override.yml using image ghcr.io/misp/misp-docker/misp-modules:latest for deployments that need MISP's own enrichment pipeline alongside IntelOwl's analyzers.

   4 details in Everything

4. docs update Aug 19, 2026 · issue 050

   IntelOwl 6.8.0 adds an optional self-hosted MISP instance deployable with a single --misp flag alongside IntelOwl.

   • Adds --misp flag to deploy a self-hosted MISP instance via the docker/misp.override.yml compose file, starting three containers: misp-core (MISP web app at https://misp-core), misp-db (MariaDB 10.11), and misp-redis (Valkey/Redis-compatible cache).
   • Default MISP credentials are pre-configured in docker/env_file_misp (admin email admin@admin.test, API key mispdefaultintelowladminapikeychgme01234, org IntelOwl) — changeable before production deployment.
   • Connects IntelOwl to the local MISP instance via the Django Admin or GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. plugin configuration using url_key_name, api_key_name, and ssl_check parameters, enabling push of analysis results to MISP and IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. lookups against it.

   3 details in Everything

5. docs update Aug 11, 2026 · issue 042

   IntelOwl's chatbot now surfaces the platform's job verdict — malicious/benign badge plus supporting analyzer evidence — in job summaries.

   ⤢ ⤢ ⤢
   • Adds verdict reporting to chatbot job summaries: asking Summarize job #N, Evaluate the results of job #N, or 'Is job #N malicious?' now returns IntelOwl's own verdict (matching the job page badge), along with which analyzers support, disagree with, or produced no opinion on that verdict.
   • Adds context-aware action chips to the chatbot: on a job page they suggest job-scoped actions (Summarize & evaluate, 'Which plugins ran?', Show job details), on an investigation page they suggest investigation-scoped actions, and elsewhere they offer general actions (Show my recent jobs, List my investigations).

   2 details in Everything

6. v6.7.0 Jul 2, 2026 · issue 014

   IntelOwl v6.7.0 ships an LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code.-powered threat-intel chatbot, two new analyzers, and connector health checks.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.7.0 https://github.com/intelowlproject/IntelOwl.git
   # already have the repo? check out this version:
   $ git checkout v6.7.0

   └──▷ TRY IT
   Spin up IntelOwl with the local Ollama LLM service enabled to activate the chatbot for your team.
   copy

   $ docker compose -f docker/default.yml -f docker/optional_analyzers.yml -f docker/override-ollama.yml up

   Trigger the chatbot's guardrail confirm endpoint via API to approve a pending analyze_observable action proposed by the agent.
   copy

   $ curl -X POST https://<intelowl-host>/api/chatbot/sessions/<session-id>/confirm -H 'Authorization: Token <your-token>' -H 'Content-Type: application/json' -d '{}'

   Check the chatbot health endpoint to verify Ollama is reachable before enabling the chat panel in the UI.
   copy

   $ curl -s https://<intelowl-host>/api/chatbot/health -H 'Authorization: Token <your-token>'

   • Adds a self-deployed LLM chatbot (powered by Ollama via optional Docker override) that lets analysts query IntelOwl jobs, investigations, analyzers, and playbooks in natural language over WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. with token streaming.
   • New CVE_Exploitability analyzer combines CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. and FIRST EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data to score CVE observables for exploitability.
   • New RDAPRDAPA JSON-based protocol for querying domain and IP registration data, standardized by the IETF as a modern replacement for WHOIS, giving cyber tools structured, machine-readable ownership and contact lookups. analyzer enables registration data access protocol lookups for domain and IP observables.
   • Chatbot agent supports an analyze_observable action tool with a preview-only guardrail and a separate confirm endpoint, requiring explicit user approval before triggering new analysis jobs.
   • Chatbot enforces per-user rate limiting on both REST and WebSocket entry points.

   +7 more show less

   • Chatbot exposes a health endpoint so the UI drawer can proactively probe Ollama availability before surfacing the chat panel.
   • Chatbot injects current-page context into the agent, enabling context-aware quick-action buttons in the chat panel.
   • Chat session history is retained with a configurable TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit.-based message retention policy.
   • Implements health-check capability for connectors, enabling automated liveness verification of connector integrations.
   • YETI connector and analyzer refactored to support API v2 payload and auth schemas — operators must update YETI credentials/config accordingly.
   • Adds new IPQS (IP Quality Score) features to the existing IPQS analyzer.
   • Updates GoReSym (binary symbol recovery) from v3.0.2 to v3.3.

   12 details in Everything

7. v6.6.1 Apr 20, 2026 · release notes

   Adds a workflow to monitor edge case dependency updates and fixes MISP connector performance

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.6.1 https://github.com/intelowlproject/IntelOwl.git
   # already have the repo? check out this version:
   $ git checkout v6.6.1

   • Adds a new workflow (check edge case dependency updates) for monitoring dependencies on the develop branch.
   • Eliminates N+1 HTTP requests in the MISP connector, significantly improving scan performance for large threat intel queries.

   2 details in Everything

8. v6.6.0 Apr 4, 2026 · release notes

   IntelOwl v6.6.0 adds Machofile analyzer, Playwright phishing backend, URLScan.io crawl visualizer, and Sample_Static_Analysis visualizer.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.6.0 https://github.com/intelowlproject/IntelOwl.git
   # already have the repo? check out this version:
   $ git checkout v6.6.0

   • New Machofile analyzer for static analysis of Mach-O binaries.
   • Adds Playwright as an alternative phishing analysis backend alongside the existing engine.
   • New URLScan.io Crawl Results Visualizer for URL scan jobs.
   • New Visualizer for the Sample_Static_Analysis playbook.
   • Improves generic observable type detection in the InQuest analyzer.

   +10 more show less

   • Auto-searches artifacts after a new evaluation submission.
   • Enables deleting entries from the artifact history table in the frontend.
   • Displays user existing evaluations in the UserEventModal.
   • Upgrades PostgreSQL to v18.
   • Adds an update checker management command for tracking IntelOwl version status.
   • Supports all JA4_DB JAX fingerprint types and stores them in the database.
   • OpenCTI connector now tracks partial state on failure and reduces redundant API calls.
   • Adds gosu for user switching in gunicorn containers.
   • Invalidates API tokens on password change for improved session security.
   • Replaces Watchman with django-watchfiles for development auto-reloading.

   15 details in Everything

9. v6.5.1 Feb 6, 2026 · release notes

   IntelOwl v6.5.1 adds HibpBreaches/HibpPasswords analyzers, CleanBrowsing detector, DNS4EU analyzers, and APIVoid v2 support.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v6.5.1 https://github.com/intelowlproject/IntelOwl.git
   # already have the repo? check out this version:
   $ git checkout v6.5.1

   • Adds HibpBreaches and HibpPasswords analyzers to check indicators against Have I Been Pwned breach and password datasets.
   • Adds CleanBrowsing DNS-based malicious domain detector analyzer.
   • Replaces DNS0 analyzers with DNS4EU analyzers for European privacy-respecting DNS threat detection.
   • Updates APIVoid integration to v2 API.

   4 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !DNS0 analyzers are replaced by DNS4EU analyzers — any playbooks or configurations referencing the DNS0 analyzers will need to be updated.
10. v6.5.0 Jan 2, 2026 · release notes

    IntelOwl v6.5.0 adds six new analyzers including JoeSandbox, GuardDog, and YaraX, plus a new Related Investigations API and VisualizableImage component.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.5.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.5.0

    └──▷ HOW TO FIND IT
    Detonate a suspicious file in JoeSandbox directly from IntelOwl to get dynamic analysis results alongside other analyzers.
    📍Navigate to IntelOwl UI › Submit › File, upload the sample, and select the JoeSandbox analyzer from the analyzer list before submitting.
    Scan an open-source package for malicious indicators using the GuardDog analyzer before adding it to your supply chain.
    📍Navigate to IntelOwl UI › Submit › Observable, enter the package name, select the GuardDog analyzer, and submit.
    Run YARA rules from the Yara-Forge repository against a suspicious file using the new YaraX Analyzer.
    📍Navigate to IntelOwl UI › Submit › File, upload the file, and select the YaraX analyzer to scan with the integrated Yara-Forge rule repository.
    • New Phunter Analyzer for phone number intelligence lookups.
    • New HuntingAbuseAPI Analyzer for abuse threat hunting.
    • New GuardDog Analyzer for malicious package detection.
    • New JoeSandbox Analyzer for dynamic malware sandboxingsandboxingRunning code inside a restricted environment that limits what it can access or change. The isolation reduces the impact of mistakes or untrusted code, depending on the sandbox's controls..
    • New YaraX Analyzer with Yara-Forge Rule Repository integration for YARA-based file scanning.

    +5 more show less

    • New CommandSequenceAPI added to the GreedyBear integration.
    • New Expand URL Analyzer for resolving and analyzing shortened/redirected URLs.
    • New Related Investigation API for linking jobs to related investigations.
    • New VisualizableImage component in the frontend visualizer for rendering image-based analysis output.
    • New analyzables page and user events modal added to the frontend.

    10 details in Everything

11. v6.4.0 May 20, 2025 · release notes

    IntelOwl v6.4.0 adds Nuclei, Bbot, Debloat, IPQuery, and Mullvad DNS analyzers plus GreedyBear and Malshare ingestors.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.4.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.4.0

    • New Nuclei analyzer: run Nuclei template-based scans against targets from within IntelOwl.
    • New Bbot analyzer: surface BBOT (Bighuge BLS OSINTOSINTOpen-source intelligence, collecting and analyzing information from publicly available sources. Investigators use it to learn about people, infrastructure or threats. Tool) recon results as an IntelOwl analyzer.
    • New Debloat analyzer: analyze binaries for bloat/packing detection via the Debloat tool.
    • New IPQuery analyzer: enrich IP observables using the IPQuery service.
    • New Mullvad DNS analyzer: check observables against Mullvad's DNS-based blocklists.

    +9 more show less

    • New GreedyBear ingestor: automatically pull threat intelligence feeds from GreedyBear into IntelOwl.
    • New Malshare ingestor: automatically ingest malware samples and hashes from Malshare.
    • Spamhaus analyzer gains IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. and ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. support.
    • Adds ability to search investigations by observable in the UI.
    • Frontend toggle controls for showing/hiding investigations in the UI.
    • Modals can now be closed with the Escape key in the frontend.
    • Abuse.ch integration now requires a mandatory API key.
    • The analyzers_data_model field has been removed from the job report serializer.
    • The load_env command is removed from the start script; .env files are now initialized automatically.

    14 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The analyzers_data_model field is removed from the job report serializer — any API client or integration reading that field will break.
    • !The load_env subcommand is removed from the start script; automated workflows that call load_env explicitly must be updated.
    • !Abuse.ch integrations now require a mandatory API key — existing configurations without a key will stop working.
12. v6.3.0 Feb 17, 2025 · release notes

    IntelOwl v6.3.0 adds UltraDNS and WAD analyzers, a data model visualizer, playbook flow UI, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. Docker support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.3.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.3.0

    └──▷ HOW TO FIND IT
    Detect web technologies on a domain using the new WAD analyzer to fingerprint frameworks, CMSCMSA web content management system for creating and managing digital content without writing code directly; cyber tools use CMS platforms to host documentation, portals, or reporting dashboards quickly., or CDNCDNA content delivery network, servers distributed across locations that cache and serve content near readers. It can reduce loading time and traffic to the original server. in use.
    📍In the IntelOwl UI, submit a URL or domain observable, then select the WAD analyzer from the analyzer list before running the scan.
    Enrich a domain or IP with UltraDNS passive DNS data as part of a DNS investigation playbook.
    📍In the IntelOwl UI, submit a domain or IP observable and select the UltraDNS analyzer (requires UltraDNS API key configured in PluginConfig).
    • New UltraDNS analyzer for DNS-based threat intelligence lookups.
    • New WAD (Web Application Detector) analyzer for identifying technologies on web targets.
    • New data model visualizer surfaces structured entity mappings in the UI.
    • New frontend data model mapping view for navigating analysis results by entity type.
    • Adds playbook flow visualization in the frontend, enabling users to explore and build possible playbook chains.

    +3 more show less

    • Advanced search improvements expand filtering and query capabilities in the job list.
    • ARM architecture support added to Docker integrations, enabling deployment on ARM-based hosts.
    • Updates abuse.ch service integrations (MalwareBazaar, ThreatFox) including configurable timeout parameters.

    8 details in Everything

13. v6.2.0 Jan 2, 2025 · release notes

    IntelOwl v6.2.0 adds phishing analysis framework, Elasticsearch GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands., new analyzers, and VirusTotal sample download

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.2.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.2.0

    └──▷ HOW TO FIND IT
    Enable the bundled Elasticsearch container to index all IntelOwl job results and query them via the new Search page
    📍In the console, go to the IntelOwl deployment and start the Elasticsearch container via the provided compose profile, then navigate to the UI Search page to query historical job data by observable, job_id, or analyzer result.
    Create a custom analyzer tailored to an internal API without editing config files
    📍In the IntelOwl UI, go to Plugins › Analyzers and click Create Custom Analyzer, fill in the endpoint, authentication, and observable types, then save and use it in a new scan.
    • New URL phishing analysis framework with concurrency support for automated phishing page inspection
    • New LoadFileSamePlaybook pivot enables chaining file-based analysis within the same playbook
    • New Androguard analyzer for Android APK static analysis
    • New MobSF_Service analyzer for mobile application security analysis via MobSF
    • New NERD observable analyzer for IP reputation lookups via CESNET's NERD service

    +10 more show less

    • New DShield observable analyzer for IP threat intelligence via SANS DShield
    • New urlDNA.io observable analyzers for URL threat intelligence
    • New NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. CVE analyzer for querying NIST's National Vulnerability Database
    • New document URL extraction analyzer to pull URLs embedded in documents
    • New VirusTotal suspicious-files detection capability and ability to download VT samples directly
    • Adds DataModel Plugin layer to normalize and index analyzer report output across plugins
    • Elasticsearch integration now ships as a bundled container with Kibana-ready index mappings, including job_id field
    • New Elasticsearch-backed search page in the frontend UI for querying historical job data
    • Enables creating Custom Analyzers directly from the GUI without editing config files
    • New Visualizer download button to export visualizer output

    15 details in Everything

14. v6.1.0 Aug 28, 2024 · release notes

    IntelOwl v6.1.0 adds 20+ new analyzers, a MalwareBazaar ingestor, Passive DNS playbook, and Traefik startup support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.1.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.1.0

    └──▷ HOW TO FIND IT
    Automatically ingest the latest MalwareBazaar samples into IntelOwl for continuous threat feed enrichment.
    📍Navigate to IntelOwl UI › Ingestors › Enable MalwareBazaar ingestor and assign a playbook to trigger on each new sample.
    Deploy IntelOwl behind Traefik as a reverse proxy for production environments.
    copy

    $ python start.py --traefik

    Run the new Passive DNS playbook to investigate a domain's DNS history through the dedicated visualizer.
    📍In the IntelOwl UI, submit a domain observable, select the Passive_DNS playbook, and view results in the Passive DNS visualizer.
    • New Detect-It-Easy analyzer identifies packers, compilers, and protectors in files.
    • New Malprob analyzer submits samples to the Malprob malware probability service.
    • New Orkl_Search analyzer queries the ORKL threat intelligence library.
    • New Crt.sh analyzer retrieves certificate transparency logs for a domain.
    • New Spamhaus_WQS analyzer checks domains/IPs against the Spamhaus Web Query Service.

    +28 more show less

    • New Spamhaus_DROP analyzer checks IPs against Spamhaus DROP/EDROP blocklists.
    • New AdGuard DNS analyzer resolves indicators via AdGuard's DNS-over-HTTPSDNS-over-HTTPSA protocol that tunnels DNS queries inside encrypted HTTPS requests, hiding lookups from network observers. Cyber tools use it to evade DNS-based monitoring or filtering. service.
    • New JA4DB analyzer looks up JA4JA4A network fingerprinting method that hashes observable TLS handshake fields into a short, readable tag, giving cyber tools a stable, version-agnostic way to classify clients and detect anomalies. TLS fingerprints against the JA4 database.
    • New GoReSym analyzer extracts Go symbols, types, and metadata from compiled binaries.
    • New LeakIX analyzer queries LeakIX for exposed services and data leaks.
    • New APIVoid analyzer checks URLs, IPs, and domains via the APIVoid threat intelligence API.
    • New IOCExtract analyzer parses raw text to extract indicators of compromiseindicators of compromiseAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself..
    • New IocFinder analyzer parses and normalizes IOCsIOCsAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. from unstructured text.
    • New CriminalIP analyzer queries Criminal IP for IP/domain threat intelligence.
    • New CriminalIP_Scan analyzer triggers an active scan on Criminal IP.
    • New PolySwarm analyzer submits files and hashes to the PolySwarm malware intelligence platform.
    • New Knock analyzer performs subdomain enumeration on domains.
    • New MobSF analyzer performs static analysis of Android/iOS apps via MobSF.
    • New Droidlysis analyzer performs static analysis of Android APKs.
    • New APK Artifacts analyzer extracts artifacts from Android APKs.
    • New PDF URI extractor and pivoting analyzer pulls URIs from PDF files and enables pivoting.
    • Improved PE_info analyzer with expanded PE metadata extraction.
    • Improved Quad9 analyzers with enhanced DNS resolution capabilities.
    • New MalwareBazaar ingestor automatically pulls fresh samples from MalwareBazaar into IntelOwl.
    • New Passive DNS playbook and visualizer for streamlined passive DNS investigation workflows.
    • Supports playbook selection for pivot and ingestor actions, giving analysts control over post-trigger analysis.
    • Adds Traefik startup option via --traefik / --traefik_local flags for reverse-proxy deployments.
    • Frontend scan form no longer requires selecting an analyzer, allowing playbook-only submissions.
    • Replaced the scan form time picker with a date picker for more intuitive time range selection.
    • Added external link output in analysis results for direct navigation to source platforms.
    • Auto-creates a default test user when running with debug=true, simplifying development setup.
    • Adds email sender capability for notification workflows.
    • Removed reCAPTCHA requirement from the registration flow.

    33 details in Everything

15. v6.0.4 Jun 5, 2024 · release notes

    Adds Visualizer Framework table element and improves job reports in IntelOwl v6.0.4

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.4 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.0.4

    • Introduces the Visualizer Framework - Table element for displaying data in the UI
    • Improves job reports with updated visualizer components

    2 details in Everything

16. v6.0.3 May 21, 2024 · release notes

    IntelOwl v6.0.3 adds PCAPPCAPA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. playbooks, new HudsonRock integration, and healthchecks for URL plugins.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.3 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.0.3

    • Adds a new playbook specifically for PCAP files analysis
    • Adds hudsonrock as a new integratable analyzer
    • Enables default healthchecks for plugins configured with the url option

    3 details in Everything

17. v6.0.2 May 13, 2024 · release notes

    IntelOwl v6.0.2 adds ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. and IP2WHOIS analyzers, playbook support, and Elastic8 compatibility.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.2 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.0.2

    • Adds ASN maxmind integration as a new analyzer
    • Adds IP2WHOIS analyzer for WHOIS data lookups
    • Introduces the Starting playbooks feature for automated workflows
    • Supports Elastic8 and removes support for older versions of Elasticsearch

    4 details in Everything

18. v6.0.0 Mar 28, 2024 · release notes

    IntelOwl v6 adds Analysis Framework, Websocket updates, MISP and Dns0 API integrations, and investigation renaming

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v6.0.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v6.0.0

    • Adds Analysis framework to allow nested analysis operations.
    • Adds WebSocketWebSocketA protocol that upgrades an HTTP connection into a persistent, full-duplex channel, letting a server push data to a client without repeated polling. Cyber tools use it for real-time event streaming and live command output. support for real-time communication.
    • Integrates the DNS0 API as a new analyzer.
    • Integrates MISP (Mitre Information Sharing Platform) as a new connector.
    • Integrates Zippy_scan analyzer.

    +7 more show less

    • Integrates Validin analyzer.
    • Integrates PhoneInfoga analyzer.
    • Adds Ip2location analyzer.
    • Adds IPQualityScore Observable Analyzer.
    • Renames analysis to investigation across the tool.
    • Enables multiline configuration for plugins.
    • Generates DJANGO_SECRET automatically during setup.

    12 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The term analysis has been renamed to investigation, potentially affecting references, URLs, or configuration keys using the old terminology.
19. v2.4.0 May 24, 2021 · release notes

    IntelOwl v2.4.0 adds Malpedia analyzer and --django-server CLI option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.4.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v2.4.0

    └──▷ TRY IT
    Start the IntelOwl backend with automatic code reloading for local development.
    copy

    $ python manage.py runserver --django-server

    • Adds new Malpedia analyzer for threat intelligence lookups
    • Adds --django-server CLI flag to start the backend in development mode with auto-reload

    2 details in Everything

20. v2.3.0 Apr 15, 2021 · release notes

    IntelOwl v2.3.0 adds ThreatFox, GreyNoise Community, FireHol, SSAPINet, X-Force, Google Web Risk analyzers and new API docs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.3.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v2.3.0

    • Adds ThreatFox Abuse.ch analyzer for observables
    • Adds GreyNoise Community analyzer for IP addresses
    • Adds FireHol analyzer to detect malicious IP addresses
    • Adds SSAPINet analyzer to capture a screenshot of a web page
    • Adds optional Google Rendertron analyzer to capture a screenshot of a web page without using an external source

    +2 more show less

    • Adds IBM X-Force Exchange analyzer for observables
    • Adds Google Web Risk analyzer, an alternative of GoogleSafeBrowsing for commercial purposes

    7 details in Everything

21. v2.1.0 Jan 25, 2021 · release notes

    IntelOwl v2.1.0 adds CRXCavator for Chrome extensions and CERT Polska MWDB for files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • Adds the CRXCavator inbuilt analyzer to detect malicious Chrome extensions.
    • Adds the CERT Polska MWDB inbuilt analyzer to scan malicious files.
    • Updates Maxmind analyzer to retrieve City data alongside existing geolocation information.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The docker-compose file names for optional analyzers have changed, requiring updates to existing Docker configurations.
22. v2.0.0 Jan 2, 2021 · release notes

    IntelOwl v2.0.0 adds 9 new analyzers and generic observables; requires docker/ folder migration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    • Qiling file analyzer now available as an optional analyzer
    • Stratosphere blacklists observable analyzer added for attacker IP prioritization
    • FireEye Red Team Tool Countermeasures Yara rules analyzer included
    • emailrep.io analyzers for email reputation checks
    • Triage observable analyzer added via search API

    +6 more show less

    • New InQuest analyzer support for malware analysis
    • WiGLEWiGLEA crowdsourced database and website that maps wireless networks and cell towers worldwide, collected by volunteers wardriving. Cyber tools use it to geolocate networks by BSSID or SSID during reconnaissance. analyzer for wireless network geolocation data
    • FireEye Floss and Manalyze file analyzers in the optional static_analyzers container
    • generic observable type now supported for custom analyzer targets
    • Multi-queue option available to optimize Celery queue usage
    • env_file_app, env_file_postgres, env_file_integrations moved into docker/ directory

    11 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !env_file_app, env_file_postgres, and env_file_integrations must be manually moved into the docker/ folder.
    • !Use start.py to build or start containers instead of previous methods.
23. v1.9.1 Dec 1, 2020 · release notes

    IntelOwl v1.9.1 adds MalwareBazaar Google Observable, InQuest YARA, and StrangerealIntel DailyIOC analyzers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.1 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.9.1

    • Adds MalwareBazaar_Google_Observable analyzer to check IPs, domains, or URLs against MalwareBazaar via Google search
    • Adds InQuest YARA rules analyzer using InQuest's YARA rule set
    • Adds StrangerealIntel Daily Ioc Yara rules analyzer using StrangerealIntel's daily IOCIOCAn indicator of compromise, an observable clue that may point to malicious activity, such as a suspicious file hash or domain. It is evidence to investigate, rather than proof by itself. YARA rules

    3 details in Everything

24. v1.9.0 Nov 23, 2020 · release notes

    Adds six new inbuilt analyzers including Tria.ge, Zoomeye, Dnstwist, Ipinfo, and two YARA rule sets.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    • Added Triage file analyzer for malware triage.
    • Added Zoomeye analyzer for search engine integration.
    • Added Dnstwist analyzer for domain mutation detection.
    • Added Ipinfo analyzer for IP address intelligence.
    • Added ReversingLabs YARA rules analyzer.

    +1 more show less

    • Added Samir YARA rules analyzer.

    6 details in Everything

25. v1.7.1 Sep 28, 2020 · release notes

    Adds XLMMacroDeobfuscator analyzer for malicious document analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

26. v1.7.0 Sep 20, 2020 · release notes

    IntelOwl v1.7.0 adds three new analyzers: UnpacMe_EXE_Unpacker, CheckDMARC, and Whoisxmlapi.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

    • Adds UnpacMe_EXE_Unpacker analyzer for automated malware unpacking via the UnpacMe service
    • Adds CheckDMARC analyzer for SPFSPFAn email authentication standard that lets a domain owner publish, via DNS, which mail servers are authorized to send on its behalf, so receiving servers can reject spoofed senders. and DMARC DNS records validation via checkdmarc
    • Adds Whoisxmlapi analyzer to fetch WHOIS record data for domains, IPs, or email addresses

    3 details in Everything

27. v1.6.0 Sep 2, 2020 · release notes

    Adds FireEye Speakeasy analyzer to IntelOwl v1.6.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • speakeasy is now available as a new malware analysis analyzer.

    1 detail in Everything

28. v1.5.0 Aug 26, 2020 · release notes

    Adds runtime_configuration JSON field for per-scan dynamic configuration and IntelligenceX phonebook integration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ USE IT
    Pass dynamic configuration for a specific scan request via the API.
    shell copy

    curl -X POST /api/v1/analyze -H 'Content-Type: application/json' -d '{"analyzers_requested": ["IntelX_Phonebook"], "runtime_configuration": {"max_results": 50}}'

    • Accepts a runtime_configuration JSON field in scan requests to enable dynamic configuration per scan.
    • Adds IntelligenceX's phonebook API as a new observable intelligence source.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Moved ldap_config.py under configuration/ directory.
29. v1.4.0 Aug 20, 2020 · release notes

    IntelOwl v1.4.0 adds inbuilt Pulsedive and Quark-engine analyzers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds inbuilt integration for Pulsedive analyzer for IP, URL, Domain and Hash observables with rate limit of 30 requests/minute.
    • Adds inbuilt integration for Quark-engine (Obfuscation-Neglect Android Malware Scoring System) for APK analysis.

    2 details in Everything

30. v1.3.0 Aug 16, 2020 · release notes

    IntelOwl v1.3.0 adds Django groups permissions, Elastic Search integration, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. auth

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • Adds DJANGO_GROUPS_PERMISSIONS configuration to leverage Django's permissions system for organizing users into groups and marking jobs as private
    • Adds ELASTIC_SEARCH_* environment variables (e.g., ELASTIC_SEARCH_HOST) to enable auto-sync of analysis data between PostgreSQL and an Elastic Search index
    • Includes a preconfigured Kibana configuration file (kibana_config.ndjson) for importable visualizations and dashboards when Elastic Search is enabled
    • Adds support for LDAP authentication via standard Django AUTHENTICATION_BACKENDS settings

    4 details in Everything

31. v1.2.0 Jul 27, 2020 · release notes

    IntelOwl v1.2.0 adds Capa, Box-JS, APKiD analyzers and extends hash support to 128 chars

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Capa by FireEye, Box-JS, and APKiD added as optional analyzer integrations.
    • Support for scanning SHA256/512 hashes with a new max length of 128 chars (resolves issue #129).

    2 details in Everything

32. v1.1.0 Jul 15, 2020 · release notes

    IntelOwl v1.1.0 adds Thug honeyclient analyzer and web UI navigation improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ HOW TO FIND IT
    Navigate the updated web interface to filter analysis results more easily
    📍In the IntelOwl web client, go to the Analysis Results section and use the new improved navigation/filtering controls to find specific analyzer outputs.
    • now supports the Thug honeyclient analyzer for URL, Domain, and HTML file analysis via an optional Docker container
    • "Improvements on the web interface for easier navigation/filtering of analysis results"

    2 details in Everything

33. 0.4.0 Apr 16, 2020 · release notes

    IntelOwl 0.4.0 adds separated Docker-based analyzers and 21 new detection integrations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.4.0 https://github.com/intelowlproject/IntelOwl.git
    # already have the repo? check out this version:
    $ git checkout 0.4.0

    • Adds the ability to integrate analysis tools as separated Docker-based analyzers (PEframe is the first)
    • Adds PEframe analyzer for static analysis of Portable Executable malware and malicious MS Office documents
    • Adds MalwareBazaar_Get_File analyzer to check if a particular malware sample is known to MalwareBazaar
    • Adds Censys_Search analyzer to scan an IP address against Censys View API
    • Adds URLhaus analyzer to query a domain or URL against URLhaus API

    +17 more show less

    • Adds MalwareBazaar_Get_Observable analyzer to check if a particular malware hash is known to MalwareBazaar
    • Adds GreyNoise analyzer to scan an IP against the Greynoise API (requires API key)
    • Adds ONYPHE analyzer to search an observable in the ONYPHE database
    • Adds HoneyDB_Get analyzer for IP lookup service
    • Adds Threatminer_PDNS analyzer to retrieve PDNS data from Threatminer API
    • Adds Threatminer_Reports_Tagging analyzer to retrieve reports from Threatminer API
    • Adds Threatminer_Subdomains analyzer to retrieve subdomains from Threatminer API
    • Adds ActiveDNS_Google analyzer to retrieve current domain resolution with Google DoHDoHDNS over HTTPS, an IETF standard (RFC 8484) that tunnels DNS queries inside encrypted HTTPS traffic, making resolution indistinguishable from web traffic and bypassing traditional DNS-based monitoring. (DNS over HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate.)
    • Adds ActiveDNS_CloudFlare analyzer to retrieve current domain resolution with CloudFlare DoH (DNS over HTTPS)
    • Adds ActiveDNS_Classic analyzer to retrieve current domain resolution with default DNS
    • Adds Auth0 analyzer to scan an IP against the Auth0 API
    • Adds Securitytrails_IP_Neighbours analyzer to scan an IP against securitytrails API for neighbour IPs
    • Adds Securitytrails_Details analyzer to scan a domain against securitytrails API for general details
    • Adds Securitytrails_Subdomains analyzer to scan a domain against securitytrails API for subdomains
    • Adds Securitytrails_Tags analyzer to scan a domain against securitytrails API for tags
    • Adds Securitytrails_History_WHOIS analyzer to scan a domain against securitytrails API for historical WHOIS
    • Adds Securitytrails_History_DNS analyzer to scan a domain against securitytrails API for historical DNS

    22 details in Everything