Taranis AI is an open-source OSINT workbench that uses NLP and AI to collect, enrich and refine public news into structured intelligence reports for authorized security teams.
| Tool | taranis-ai/taranis-ai — AI-assisted OSINT collection, enrichment and reporting platform with 1218 stars, EUPL-1.2 licensed |
| Category | OSINT / threat intelligence collection and reporting platform |
| Primary Use | Automating collection of unstructured news from websites, RSS/Atom, Mastodon, MISP and Request Tracker, then refining it into structured, publishable reports |
| Safe Use | Designed for CERT/CSIRT and threat-intelligence teams performing authorized, defensive situational awareness on publicly available information |
| Telemetry Note | Purely passive collection of public sources; leaves no artifacts on targets — its own footprint is outbound HTTP fetches to feeds and optional calls to an OpenAI-compatible API, observable via egress logs |
Taranis AI positions itself as an advanced Open-Source Intelligence workbench that applies Artificial Intelligence and Natural Language Processing to the unglamorous middle of the intelligence cycle: turning a firehose of unstructured public news into structured, reviewable, publishable reports. Rather than being another scraping library, it is a full platform — collection, enrichment, analyst review, presentation and publishing — assembled as a set of cooperating containerized services. With over twelve hundred stars, a Python codebase and the EUPL-1.2 license, it is a serious community project with visible European public-sector lineage: the README notes it was co-financed by the Connecting Europe Facility of the European Union and inspired by Taranis3 from the Dutch NCSC and Taranis-NG from SK-CERT.
Architecturally, the README describes a clean microservice decomposition. An ingress service runs Nginx as a reverse proxy entrypoint in front of everything. The frontend is a Flask, HTMX and tailwindcss application exposing the REST-driven user interface — a notably conservative stack choice that avoids a heavy JavaScript SPA in favor of server-rendered interactivity. The core service is the central component: it owns database communication and offers REST endpoints consumed by both the frontend and the workers. Finally, worker services run on RQ and provide the pluggable collectors, bots, presenters and publishers that do the actual pipeline labor.
Support services round out the deployment: PostgreSQL as the primary database (with SQLite supported as a lighter alternative, though the README is explicit that PostgreSQL is the primary citizen), redis as message broker and job queue for the RQ workers, and Centrifugo for realtime updates to connected analyst sessions. One interesting migration note for existing deployments: the project ships an RQ Migration Guide at dev/rq_migration_guide.md for teams coming from earlier Celery/RabbitMQ architectures — evidence of a deliberate simplification of the async stack toward Redis-native job processing.
The workflow described in the README is worth parsing carefully because it defines the tool's philosophy. Workers retrieve OSINT information from sources such as websites, RSS/Atom feeds, Mastodon, MISP and Request Tracker, producing raw news items. AI and NLP then automatically enhance and enrich those collected articles — the README frames this as improving content quality before human eyes touch it. Only then do human analysts enter the loop, refining AI-augmented articles into structured report items that become the foundation for deliverables such as PDF files, which are ultimately published. The design keeps the human explicitly in the loop as editor and approver, which is the right posture for intelligence products where attribution and accuracy matter.
The collector surface is deliberately heterogeneous. Beyond generic web and feed collection, the docs include a dedicated docs/mastodon.md covering Mastodon collection with access-token HTTPS requirements and two cursor modes — complete versus latest — which suggests the team has thought through the pagination semantics of ActivityPub-style timelines. docs/intelowl.md describes an IntelOwl enrichment setup, letting Taranis pull analytical enrichment from that well-known analysis framework. And the experimental collaborative threat-intelligence feature supports story-level sharing between Taranis AI instances via MISP, or directly between Taranis and MISP, making it a plausible node in a broader sharing community rather than a silo.
The optional Analyst Chat feature is the most modern addition: persistent, per-user conversations that can answer general questions or search the stories the analyst is authorized to see, backed by a separately configured OpenAI-compatible Responses API. Two things stand out here from an operational perspective. First, the authorization scoping of chat search — the assistant only sees stories the analyst is permitted to view — indicates the permission model extends into the AI layer rather than being bypassed by it. Second, the phrase OpenAI-compatible means any endpoint implementing that API shape can serve as the backend, giving deployers control over whether conversation data leaves their infrastructure at all.
For defenders running the platform, the health and observability story is pragmatic. The README documents two unauthenticated core endpoints: /api/isalive, a lightweight liveness probe confirming the core API process responds, and /api/health, an operational endpoint reporting dependency status as up, down or n/a and returning HTTP 503 if any dependency is down, 200 otherwise. These are exactly the primitives you want wired into container orchestrators or external uptime monitoring, and their documentation in the README itself signals deployment maturity. An OpenAPI 3.1 specification for the REST API ships at src/core/core/static/openapi3_1.yaml and is served under config/openapi in a running installation — the README even embeds the Swagger validator badge for it — so automation and integration against the API is fully self-service.
Hardware requirements are honestly bimodal, which tells you where the real resource cost lives. Full NLP operation wants at least 16 GB RAM, 4 CPU cores and 50 GB disk, while a deployment without NLP runs comfortably on 2 GB RAM, 2 cores and 20 GB. That roughly eightfold memory gap is a useful signal that local language-model inference is the dominant workload, and teams should size accordingly rather than discovering it under load. Production deployments are expected via docker compose, with support files and an example compose file under docker/.
The codebase layout mirrors the service split: src/core for the REST API, src/ingress for Nginx configuration, src/frontend for the Flask/HTMX UI, src/models for pydantic models validating inputs and outputs, and src/worker for the collection machinery. The explicit use of pydantic for boundary validation is a good sign for API robustness. The project also maintains SBOM scope and attestations for container and Python dependencies at docs/sbom.md and documented maintainer release steps at docs/releasing.md — supply-chain hygiene artifacts that security teams evaluating the tool will appreciate.
Where does Taranis AI fit in an authorized workflow? It is a threat-intelligence and situational-awareness production system, closest in spirit to the news-aggregation and reporting tooling used by national CERTs — unsurprising given its NCSC-NL and SK-CERT ancestry. For a SOC or CSIRT that must produce daily intelligence summaries from public sources, it replaces ad-hoc scrapers, spreadsheets and manual paste-and-prune with a supervised pipeline where AI does first-pass enrichment and analysts do judgment. It is entirely collection-side and passive, and its value is in defensibility: every published product traces back through an analyst-curated chain. A typical setup starts with the documented docker compose deployment guide at taranis.ai/docs, followed by configuring collectors and — if AI assistance is wanted — pointing the separately configured OpenAI-compatible endpoint at infrastructure you are authorized to use.
taranis-ai/taranis-ai.Educational analysis for authorized security professionals. Use only in controlled, authorized environments.
Related coverage
0 comentários:
Post a Comment
Note: Only a member of this blog may post a comment.