IntelGraph is an open-source threat intelligence platform that correlates IOCs across multiple intelligence feeds, resolves conflicting data, and explains why every alert was generated. It automatically ingests data from URLhaus, CISA KEV, OTX, Shodan, and VirusTotal, builds a knowledge graph of relationships between IPs, domains, and CVEs, supports STIX 2.1/TAXII 2.1 export for SIEM integration, and includes automated response playbooks.
No reviews yetBe the first to leave a review for IntelGraph
Maker
📌
I built IntelGraph to make threat intelligence more transparent and actionable. Many existing platforms aggregate IOCs but don't clearly explain why an alert was generated or how different sources relate to each other.
IntelGraph automatically correlates threat data from URLhaus, CISA KEV, OTX, Shodan, and VirusTotal, merges duplicate entities, builds an interactive knowledge graph, and generates an explainable evidence chain for every alert. It also supports STIX 2.1/TAXII 2.1 export and automated response playbooks.
The project is built with Python, FastAPI, SQLite, and D3.js, with over **1,535 automated tests**.
I'd really appreciate feedback from security engineers, SOC analysts, threat hunters, and OSINT researchers. What features would make IntelGraph more useful in your daily workflow?
Report
How does it actually handle conflicts when two feeds tag the same IP with very different reputations, like one calling it benign and another calling it malicious?
Report
Maker
@hamdi278206 Great question, Hamdi. IntelGraph doesn't just take a vote — it preserves each source's claim as evidence and lets the user see the full picture. When two sources disagree, the platform surfaces the conflict explicitly in the explainability output, showing which source said what, with timestamps and confidence levels. The threat score is computed from multiple factors (evidence breadth, relationship depth, temporal activity, malicious signals), so a single "benign" tag from a lower-confidence source won't override consistent malicious signals from higher-confidence feeds. The key design choice is transparency: the analyst sees why the score lands where it does, not just a final verdict.
Report
Pulled it down last night and pointed it at our SIEM. The explainable alert reasoning alone is worth it, finally tells my analysts why an IOC was flagged instead of just throwing a hash at them.
Thank you again for taking the time to try IntelGraph and for sharing your feedback—it really means a lot.
If you continue to find it useful, I'd really appreciate it if you could star the project on GitHub. It helps the project reach more people and supports its growth.
How does it actually handle conflicts when two feeds tag the same IP with very different reputations, like one calling it benign and another calling it malicious?
@hamdi278206 Great question, Hamdi. IntelGraph doesn't just take a vote — it preserves each source's claim as evidence and lets the user see the full picture. When two sources disagree, the platform surfaces the conflict explicitly in the explainability output, showing which source said what, with timestamps and confidence levels. The threat score is computed from multiple factors (evidence breadth, relationship depth, temporal activity, malicious signals), so a single "benign" tag from a lower-confidence source won't override consistent malicious signals from higher-confidence feeds. The key design choice is transparency: the analyst sees why the score lands where it does, not just a final verdict.
Pulled it down last night and pointed it at our SIEM. The explainable alert reasoning alone is worth it, finally tells my analysts why an IOC was flagged instead of just throwing a hash at them.
@tekkanat_f95054 Hi Faruk,
Thank you again for taking the time to try IntelGraph and for sharing your feedback—it really means a lot.
If you continue to find it useful, I'd really appreciate it if you could star the project on GitHub. It helps the project reach more people and supports its growth.
https://github.com/Berkayy123-h/intelgraph
Thanks again for your support!