https://cybertoolchain.io/tools/intelowl New releases and features in IntelOwl, tracked by The Cyber Toolchain. en Mon, 31 Aug 2026 18:53:50 GMT https://github.com/intelowlproject/IntelOwl/releases/tag/v6.8.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.8.0 Mon, 31 Aug 2026 18:53:50 GMT IntelOwl v6.8.0 adds a CTIConnector base class, chatbot improvements with OLLAMA_KEEP_ALIVE support, and richer connector health-check UI messages. • Introduces `CTIConnector` base class to standardize CTI connectors and support data-model enrichment across connector implementations. • Chatbot now defaults `analyze_observable` to a curated playbook and enforces rejection of placeholder names, preventing accidental stub submissions. • Connector health-check methods now return a (status, message) tuple, and the UI surfaces the full error message when a health check fails. • Hardens chatbot jobs-vs-investigations routing and accepts null filter arguments, broadening the range of valid chatbot queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.7.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.7.0 Thu, 02 Jul 2026 06:40:27 GMT IntelOwl v6.7.0 ships an LLM-powered threat-intel chatbot, two new analyzers, and connector health checks. • Adds a self-deployed LLM chatbot (powered by Ollama via optional Docker override) that lets analysts query IntelOwl jobs, investigations, analyzers, and playbooks in natural language over WebSocket with token streaming. • New CVE_Exploitability analyzer combines CISA KEV and FIRST EPSS data to score CVE observables for exploitability. • New RDAP analyzer enables registration data access protocol lookups for domain and IP observables. • Chatbot agent supports an `analyze_observable` action tool with a preview-only guardrail and a separate confirm endpoint, requiring explicit user approval before triggering new analysis jobs. • Chatbot enforces per-user rate limiting on both REST and WebSocket entry points. • Chatbot exposes a health endpoint so the UI drawer can proactively probe Ollama availability before surfacing the chat panel. • Chatbot injects current-page context into the agent, enabling context-aware quick-action buttons in the chat panel. • Chat session history is retained with a configurable TTL-based message retention policy. • Implements health-check capability for connectors, enabling automated liveness verification of connector integrations. • YETI connector and analyzer refactored to support API v2 payload and auth schemas — operators must update YETI credentials/config accordingly. • Adds new IPQS (IP Quality Score) features to the existing IPQS analyzer. • Updates GoReSym (binary symbol recovery) from v3.0.2 to v3.3. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.6.1 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.6.1 Mon, 20 Apr 2026 19:10:47 GMT Adds a workflow to monitor edge case dependency updates and fixes MISP connector performance • Adds a new workflow (`check edge case dependency updates`) for monitoring dependencies on the `develop` branch. • Eliminates N+1 HTTP requests in the MISP connector, significantly improving scan performance for large threat intel queries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.6.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.6.0 Sat, 04 Apr 2026 19:10:51 GMT IntelOwl v6.6.0 adds Machofile analyzer, Playwright phishing backend, URLScan.io crawl visualizer, and Sample_Static_Analysis visualizer. • New Machofile analyzer for static analysis of Mach-O binaries. • Adds Playwright as an alternative phishing analysis backend alongside the existing engine. • New URLScan.io Crawl Results Visualizer for URL scan jobs. • New Visualizer for the Sample_Static_Analysis playbook. • Improves generic observable type detection in the InQuest analyzer. • Auto-searches artifacts after a new evaluation submission. • Enables deleting entries from the artifact history table in the frontend. • Displays user existing evaluations in the UserEventModal. • Upgrades PostgreSQL to v18. • Adds an update checker management command for tracking IntelOwl version status. • Supports all JA4_DB JAX fingerprint types and stores them in the database. • OpenCTI connector now tracks partial state on failure and reduces redundant API calls. • Adds gosu for user switching in gunicorn containers. • Invalidates API tokens on password change for improved session security. • Replaces Watchman with django-watchfiles for development auto-reloading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.5.1 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.5.1 Fri, 06 Feb 2026 16:35:25 GMT IntelOwl v6.5.1 adds HibpBreaches/HibpPasswords analyzers, CleanBrowsing detector, DNS4EU analyzers, and APIVoid v2 support. • Adds HibpBreaches and HibpPasswords analyzers to check indicators against Have I Been Pwned breach and password datasets. • Adds CleanBrowsing DNS-based malicious domain detector analyzer. • Replaces DNS0 analyzers with DNS4EU analyzers for European privacy-respecting DNS threat detection. • Updates APIVoid integration to v2 API. Breaking changes: • DNS0 analyzers are replaced by DNS4EU analyzers — any playbooks or configurations referencing the DNS0 analyzers will need to be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.5.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.5.0 Fri, 02 Jan 2026 16:46:23 GMT IntelOwl v6.5.0 adds six new analyzers including JoeSandbox, GuardDog, and YaraX, plus a new Related Investigations API and VisualizableImage component. • New Phunter Analyzer for phone number intelligence lookups. • New HuntingAbuseAPI Analyzer for abuse threat hunting. • New GuardDog Analyzer for malicious package detection. • New JoeSandbox Analyzer for dynamic malware sandboxing. • New YaraX Analyzer with Yara-Forge Rule Repository integration for YARA-based file scanning. • New CommandSequenceAPI added to the GreedyBear integration. • New Expand URL Analyzer for resolving and analyzing shortened/redirected URLs. • New Related Investigation API for linking jobs to related investigations. • New VisualizableImage component in the frontend visualizer for rendering image-based analysis output. • New analyzables page and user events modal added to the frontend. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.4.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.4.0 Tue, 20 May 2025 07:49:31 GMT IntelOwl v6.4.0 adds Nuclei, Bbot, Debloat, IPQuery, and Mullvad DNS analyzers plus GreedyBear and Malshare ingestors. • New Nuclei analyzer: run Nuclei template-based scans against targets from within IntelOwl. • New Bbot analyzer: surface BBOT (Bighuge BLS OSINT Tool) recon results as an IntelOwl analyzer. • New Debloat analyzer: analyze binaries for bloat/packing detection via the Debloat tool. • New IPQuery analyzer: enrich IP observables using the IPQuery service. • New Mullvad DNS analyzer: check observables against Mullvad's DNS-based blocklists. • New GreedyBear ingestor: automatically pull threat intelligence feeds from GreedyBear into IntelOwl. • New Malshare ingestor: automatically ingest malware samples and hashes from Malshare. • Spamhaus analyzer gains IPv6 and ASN support. • Adds ability to search investigations by observable in the UI. • Frontend toggle controls for showing/hiding investigations in the UI. • Modals can now be closed with the Escape key in the frontend. • Abuse.ch integration now requires a mandatory API key. • The `analyzers_data_model` field has been removed from the job report serializer. • The `load_env` command is removed from the `start` script; `.env` files are now initialized automatically. Breaking changes: • The `analyzers_data_model` field is removed from the job report serializer — any API client or integration reading that field will break. • The `load_env` subcommand is removed from the `start` script; automated workflows that call `load_env` explicitly must be updated. • Abuse.ch integrations now require a mandatory API key — existing configurations without a key will stop working. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.3.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.3.0 Mon, 17 Feb 2025 17:39:35 GMT IntelOwl v6.3.0 adds UltraDNS and WAD analyzers, a data model visualizer, playbook flow UI, and ARM Docker support. • New UltraDNS analyzer for DNS-based threat intelligence lookups. • New WAD (Web Application Detector) analyzer for identifying technologies on web targets. • New data model visualizer surfaces structured entity mappings in the UI. • New frontend data model mapping view for navigating analysis results by entity type. • Adds playbook flow visualization in the frontend, enabling users to explore and build possible playbook chains. • Advanced search improvements expand filtering and query capabilities in the job list. • ARM architecture support added to Docker integrations, enabling deployment on ARM-based hosts. • Updates abuse.ch service integrations (MalwareBazaar, ThreatFox) including configurable timeout parameters. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.2.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.2.0 Thu, 02 Jan 2025 09:41:59 GMT IntelOwl v6.2.0 adds phishing analysis framework, Elasticsearch GUI, new analyzers, and VirusTotal sample download • New URL phishing analysis framework with concurrency support for automated phishing page inspection • New `LoadFileSamePlaybook` pivot enables chaining file-based analysis within the same playbook • New Androguard analyzer for Android APK static analysis • New MobSF_Service analyzer for mobile application security analysis via MobSF • New NERD observable analyzer for IP reputation lookups via CESNET's NERD service • New DShield observable analyzer for IP threat intelligence via SANS DShield • New urlDNA.io observable analyzers for URL threat intelligence • New NVD CVE analyzer for querying NIST's National Vulnerability Database • New document URL extraction analyzer to pull URLs embedded in documents • New VirusTotal suspicious-files detection capability and ability to download VT samples directly • Adds DataModel Plugin layer to normalize and index analyzer report output across plugins • Elasticsearch integration now ships as a bundled container with Kibana-ready index mappings, including `job_id` field • New Elasticsearch-backed search page in the frontend UI for querying historical job data • Enables creating Custom Analyzers directly from the GUI without editing config files • New Visualizer download button to export visualizer output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.1.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.1.0 Wed, 28 Aug 2024 08:56:57 GMT IntelOwl v6.1.0 adds 20+ new analyzers, a MalwareBazaar ingestor, Passive DNS playbook, and Traefik startup support. • New Detect-It-Easy analyzer identifies packers, compilers, and protectors in files. • New Malprob analyzer submits samples to the Malprob malware probability service. • New Orkl_Search analyzer queries the ORKL threat intelligence library. • New Crt.sh analyzer retrieves certificate transparency logs for a domain. • New Spamhaus_WQS analyzer checks domains/IPs against the Spamhaus Web Query Service. • New Spamhaus_DROP analyzer checks IPs against Spamhaus DROP/EDROP blocklists. • New AdGuard DNS analyzer resolves indicators via AdGuard's DNS-over-HTTPS service. • New JA4DB analyzer looks up JA4 TLS fingerprints against the JA4 database. • New GoReSym analyzer extracts Go symbols, types, and metadata from compiled binaries. • New LeakIX analyzer queries LeakIX for exposed services and data leaks. • New APIVoid analyzer checks URLs, IPs, and domains via the APIVoid threat intelligence API. • New IOCExtract analyzer parses raw text to extract indicators of compromise. • New IocFinder analyzer parses and normalizes IOCs from unstructured text. • New CriminalIP analyzer queries Criminal IP for IP/domain threat intelligence. • New CriminalIP_Scan analyzer triggers an active scan on Criminal IP. • New PolySwarm analyzer submits files and hashes to the PolySwarm malware intelligence platform. • New Knock analyzer performs subdomain enumeration on domains. • New MobSF analyzer performs static analysis of Android/iOS apps via MobSF. • New Droidlysis analyzer performs static analysis of Android APKs. • New APK Artifacts analyzer extracts artifacts from Android APKs. • New PDF URI extractor and pivoting analyzer pulls URIs from PDF files and enables pivoting. • Improved PE_info analyzer with expanded PE metadata extraction. • Improved Quad9 analyzers with enhanced DNS resolution capabilities. • New MalwareBazaar ingestor automatically pulls fresh samples from MalwareBazaar into IntelOwl. • New Passive DNS playbook and visualizer for streamlined passive DNS investigation workflows. • Supports playbook selection for pivot and ingestor actions, giving analysts control over post-trigger analysis. • Adds Traefik startup option via `--traefik` / `--traefik_local` flags for reverse-proxy deployments. • Frontend scan form no longer requires selecting an analyzer, allowing playbook-only submissions. • Replaced the scan form time picker with a date picker for more intuitive time range selection. • Added external link output in analysis results for direct navigation to source platforms. • Auto-creates a default test user when running with `debug=true`, simplifying development setup. • Adds email sender capability for notification workflows. • Removed reCAPTCHA requirement from the registration flow. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.4 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.4 Wed, 05 Jun 2024 07:29:41 GMT Adds Visualizer Framework table element and improves job reports in IntelOwl v6.0.4 • Introduces the 'Visualizer Framework - Table element' for displaying data in the UI • Improves job reports with updated visualizer components Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.3 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.3 Tue, 21 May 2024 15:25:00 GMT IntelOwl v6.0.3 adds PCAP playbooks, new HudsonRock integration, and healthchecks for URL plugins. • Adds a new playbook specifically for PCAP files analysis • Adds 'hudsonrock' as a new integratable analyzer • Enables default healthchecks for plugins configured with the `url` option Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.2 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.2 Mon, 13 May 2024 10:26:01 GMT IntelOwl v6.0.2 adds ASN and IP2WHOIS analyzers, playbook support, and Elastic8 compatibility. • Adds ASN maxmind integration as a new analyzer • Adds IP2WHOIS analyzer for WHOIS data lookups • Introduces the 'Starting playbooks' feature for automated workflows • Supports Elastic8 and removes support for older versions of Elasticsearch Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.0 https://github.com/intelowlproject/IntelOwl/releases/tag/v6.0.0 Thu, 28 Mar 2024 10:47:31 GMT IntelOwl v6 adds Analysis Framework, Websocket updates, MISP and Dns0 API integrations, and investigation renaming • Adds `Analysis framework` to allow nested analysis operations. • Adds WebSocket support for real-time communication. • Integrates the DNS0 API as a new analyzer. • Integrates MISP (Mitre Information Sharing Platform) as a new connector. • Integrates Zippy_scan analyzer. • Integrates Validin analyzer. • Integrates PhoneInfoga analyzer. • Adds `Ip2location` analyzer. • Adds IPQualityScore Observable Analyzer. • Renames `analysis` to `investigation` across the tool. • Enables multiline configuration for plugins. • Generates `DJANGO_SECRET` automatically during setup. Breaking changes: • The term `analysis` has been renamed to `investigation`, potentially affecting references, URLs, or configuration keys using the old terminology. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/intelowl