A self-hosted Docker web application that unifies OSINT lookups, email analysis, phishing domain monitoring, and Sigma/YARA rule creation for authorized security analysts.
| Tool | dev-lu/osint_toolkit — self-hostable fullstack web application consolidating OSINT and threat-intelligence workflows for security analysts |
| Category | OSINT / threat-intelligence aggregation platform (JavaScript, AGPL-3.0) |
| Primary Use | Enriching IPs, domains, URLs, emails, and hashes across services like VirusTotal and AbuseIPDB, analyzing .eml files, and building Sigma/YARA/Snort detection rules |
| Safe Use | Intended for authorized defenders, SOC analysts, and threat-intelligence teams investigating indicators on networks they are chartered to protect |
| Telemetry Note | Runs locally in Docker on localhost:4000; outbound queries hit third-party intelligence APIs, so those services observe lookup volume and API key usage from the analyst's IP |
dev-lu/osint_toolkit positions itself as a self-hostable, on-demand analysis platform for security specialists, and the framing in the README is unusually honest about scope: this is an early prototype, explicitly flagged as not production ready, optimized for single-user operation inside a local Docker container. The design philosophy is consolidation — rather than juggling a dozen browser tabs for VirusTotal, Shodan, and AlienVault, the analyst gets one environment that routes an indicator to the right services automatically. The repository has gathered roughly 941 stars, is written primarily in JavaScript, and is licensed under AGPL-3.0, with a commercial licensing option for teams that want to embed it in proprietary offerings without open-sourcing modifications.
Architecturally, the project is a fullstack web application delivered via docker-compose, with a backend that appears to use alembic for database schema migrations — the README instructs running docker compose run --rm backend alembic upgrade head whenever the schema changes, which tells you the persistence layer is SQLAlchemy-style and actively evolving. The UI is served at http://localhost:4000 once the container is up. Notably, the author states the platform is not intended for long-term data storage or case management; it is a workflow accelerator, not a replacement for a proper threat-intelligence platform or SIEM, and that distinction should shape how you deploy it.
The heart of the toolkit is the IOC Tools module, which handles enrichment for IP addresses, domains, URLs, emails, hashes, and CVEs. The integrated service matrix is broad: for IPs alone it can query AbuseIPDB, AlienVault, Checkphish.ai, CrowdSec, GitHub, IPQualityScore, Maltiverse, Pulsedive, Shodan, Reddit, Twitter, ThreatFox, and VirusTotal. Domains add URLScan to that mix, URLs add Google Safe Browsing, emails add Emailrep.io, Hunter.io, and Have I Been Pwnd, and CVEs are covered through GitHub and NIST NVD. The module auto-detects the IOC type and selects the appropriate services, supports both individual and bulk analysis, and includes fanging and defanging for safe IOC sharing — a small but thoughtful operational detail.
What makes the design interesting is the deliberate inclusion of social platforms — Reddit and Twitter — alongside classic reputation APIs. This reflects how threat intelligence actually circulates today: researchers often post first sightings of malicious infrastructure on social media well before curated feeds pick it up. Querying both in parallel gives the analyst a temporal advantage, though it also means lookups are only as good as the search coverage of those platforms, and defenders should treat social-source hits as leads requiring corroboration rather than verdicts.
The Newsfeed module aggregates articles from Wired, The Hacker News, Security Magazine, Threatpost, TechCrunch Security, and Dark Reading, collapsing the daily reading ritual into a single view. More importantly, it automatically extracts IOCs from article text, which turns passive news consumption into actionable triage — you can pivot directly from a reported indicator into a full enrichment workflow. The README notes that AI assists in analyzing the news, one of several places where generative models are woven into the pipeline rather than bolted on as a chatbot sidebar.
The Email Analyzer module accepts .eml files via drag and drop, parses them, runs basic security checks, extracts IOCs, and applies AI to the message content. For incident responders and SOC analysts handling phishing reports, this covers the first five minutes of a typical triage workflow: parse, extract, enrich, summarize. The extracted indicators flow into the same OSINT service ecosystem as the IOC Tools module, so there is no context switch between email analysis and indicator research.
The Domain Finder module addresses a genuinely defensive problem: detecting phishing infrastructure before it is used against your organization. It searches for recently registered domains matching configurable patterns — think lookalike variants of a corporate brand — and uses the URLScan.io API to render screenshots of associated websites without the analyst visiting them directly, which is good OPSEC hygiene. Each candidate domain and its resolved IP can then be checked against the threat-intelligence services already integrated elsewhere in the platform, closing the loop from discovery to assessment.
Detection engineers get two more modules. The AI Templates feature supports templated AI tasks for log data analysis, email text analysis, and source code explanation, with explicit support for the prompt engineering process — the idea being that reusable, structured prompts outperform ad-hoc chatting for repetitive analytical work. The Detection Rules module is a GUI for authoring Sigma, Yara, and Snort/Suricata rules, which pairs naturally with the IOC research workflow: enrich an indicator, understand its context, then translate that understanding directly into a detection rule without leaving the application. A CVSS calculator rounds out the set, computing v3.1 scores and exporting the calculation as markdown or JSON for documentation.
Deployment is straightforward: download the repository, navigate to the directory containing docker-compose.yaml, and run docker-compose up -d. Because everything runs locally, the telemetry footprint is worth understanding from the defensive side: the platform itself is silent, but every enrichment query generates outbound requests to third-party APIs using your configured keys, so intelligence providers will see your lookup patterns and volume. Analysts investigating sensitive matters should be aware that querying an indicator through a dozen services simultaneously can signal interest in that indicator — a consideration the README does not address but that matters in adversarial contexts.
Caveats are real. The author's own warning that this is not production ready should be taken seriously: it is optimized for a single analyst, lacks multi-tenant hardening, and the database schema is still moving. The AGPL-3.0 license also has teeth for anyone embedding it into a shared service, since network-delivered modifications must be open-sourced; the commercial licensing contact exists for exactly that scenario. Versions up to and including v0.1.0 remain available under MIT, which may matter for teams that started with the earlier codebase.
Within an authorized workflow, osint_toolkit sits between raw OSINT browser work and a full commercial TIP. It will not replace a MISP instance for collaborative intelligence management, and it does not attempt long-term storage, but for a solo analyst or small SOC doing daily enrichment, phishing triage, and detection authoring in one place, it compresses a lot of tool-switching. Treat it as a fast, local workbench, deploy it inside your lab or analyst workstation, and evaluate it as the promising prototype it claims to be rather than a hardened product.
dev-lu/osint_toolkit.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.