IntelOwl is an open-source platform for open source intelligence (OSINT) and threat intelligence. Security analysts submit a file, IP address, domain or other observable and receive enriched results from a configurable set of analyzers, which query online services and run malware-analysis tools. Results appear in a web dashboard and can be retrieved through an API and the official Python and Go client libraries. The software runs on Docker, Django and React and is normally installed on the organisation's own infrastructure.
The project is maintained by Certego S.r.l., an Italian threat intelligence and managed detection company based in Modena, and is released under the AGPL-3.0 licence. Because the software can run on servers the organisation controls, analysed artefacts and queries stay in its own environment, and no vendor cloud is needed. For a European organisation, this means an EU-based maintainer and an operating environment under its own control. The external services that individual analyzers call remain third parties and need separate assessment.