IntelGraph is an open-source threat intelligence platform that correlates IOCs across multiple intelligence feeds, resolves conflicting data, and explains why every alert was generated. It automatically ingests data from URLhaus, CISA KEV, OTX, Shodan, and VirusTotal, builds a knowledge graph of relationships between IPs, domains, and CVEs, supports STIX 2.1/TAXII 2.1 export for SIEM integration, and includes automated response playbooks.

I built IntelGraph to make threat intelligence more transparent and actionable. Many existing platforms aggregate IOCs but don't clearly explain why an alert was generated or how different sources relate to each other. IntelGraph automatically correlates threat data from URLhaus, CISA KEV, OTX, Shodan, and VirusTotal, merges duplicate entities, builds an interactive knowledge graph, and generates an explainable evidence chain for every alert. It also supports STIX 2.1/TAXII 2.1 export and automated response playbooks. The project is built with Python, FastAPI, SQLite, and D3.js, with over **1,535 automated tests**. I'd really appreciate feedback from security engineers, SOC analysts, threat hunters, and OSINT researchers. What features would make IntelGraph more useful in your daily workflow?

How does it actually handle conflicts when two feeds tag the same IP with very different reputations, like one calling it benign and another calling it malicious?

Pulled it down last night and pointed it at our SIEM. The explainable alert reasoning alone is worth it, finally tells my analysts why an IOC was flagged instead of just throwing a hash at them.

How does it actually handle conflicts when two feeds tag the same IP with very different reputations, like one calling it benign and another calling it malicious?

Pulled it down last night and pointed it at our SIEM. The explainable alert reasoning alone is worth it, finally tells my analysts why an IOC was flagged instead of just throwing a hash at them.

IntelGraph

Open-source threat intelligence with explainable alerts

Open-source threat intelligence with explainable alerts