Open Source  ·  MIT License

Cross-validate IOCs.
Explain every alert.

IntelGraph correlates threat indicators from 5 intelligence sources, eliminates false positives, and generates a step-by-step evidence chain for every alert — so analysts know exactly why something triggered.

intelgraph — terminal
$ python3 -m intelgraph pipeline --sources urlhaus,otx,kev
[URLhaus] 1,247 IOCs fetched (IP: 492 · Domain: 387 · URL: 368)
[OTX] 356 pulses · 892 IOCs extracted
[CISA KEV] 12 new vulnerabilities added
 
$ intelgraph enrich 107.172.135.60
⚠ ALERT  107.172.135.60 — Command & Control server
├─ URLhaus: first seen 2025-11-03, malware: Mirai
├─ OTX: 3 pulses · tags: c2, mirai, scanner
├─ Linked domain: dgitaltrading[.]com  (risk: high)
└─ Confidence: 94% Verified across 3 sources
1,535
Automated Tests
5
Intel Sources
14
Core Engines
STIX 2.1
Export Format
Pipeline

How it works

Five-stage pipeline from raw feed data to actionable, explainable intelligence.

1

Collect

Pull IOCs automatically from URLhaus, OTX, CISA KEV, Shodan, and VirusTotal.

2

Extract

Parse IPs, domains, URLs, hashes, and CVEs from raw feed data.

3

Correlate

Build a knowledge graph — deduplicate entities and map relationships across sources.

4

Alert

Score threats, detect anomalies, and fire alerts with full evidence chains.

5

Export

Share findings as STIX 2.1 bundles or trigger playbooks via webhook.

Data Sources

Five intelligence feeds, one pipeline

Each source contributes a different signal — IntelGraph resolves conflicts between them automatically.

URLhaus
CISA KEV
AlienVault OTX
Shodan
VirusTotal
Features

Built for SOC analysts

Open source, extensible, and designed around the questions analysts actually ask.

Evidence Chains

Every alert comes with a step-by-step explanation of why it fired — not just a score.

Knowledge Graph

D3.js force-directed graph visualizes relationships between IPs, domains, CVEs, and hashes.

Contradiction Detection

Automatically flags when two sources disagree on the same indicator.

STIX 2.1 / TAXII 2.1

Standards-compliant export for Splunk, Microsoft Sentinel, MISP, and OpenCTI.

Playbook Engine

Rule-based automation: C2 IP detection, ransomware CVE response, malware domain workflows.

Real-Time Alerts

Webhook, email, and Slack notifications as threats are detected.

Multi-Tenant

Role-based access control, 2FA, OAuth2, and API key rotation built in.

Automated Reports

Scheduled threat reports in PDF-ready format via Jinja2 templates.

Ready to try it?

Request a live demo, open an issue, or just browse the code.

Request a demo Star on GitHub

berkayaltintas@intelgraph.io  ·  contact@intelgraph.io