IntelOwl

Free

IntelOwl does not print a seat price on the repository or the project site opened on 17 Oct 2026. The license field is AGPL-3.0. You deploy the Docker stack and the Django API, and the project does not host your submissions on a metered public plan. The honeynet URL is a demo shell, not a price page. Analyzer plugins often call third-party services that have their own keys and fees. Those fees are not an IntelOwl subscription, and this listing does not invent them. The site's download and analyzer counts are marketing lines. They are not a rate card. If Certego sells a hosted offer, it was not the page reviewed here.

The IntelOwl README describes enrichment of threat information for files and for observables, a Django and Python REST API, and libraries for wiring the API into other tools. It names pyintelowl. The same README says that since v6.8.0 the project's management is fully in Certego's hands and points at GitHub discussion 3654. The API on 17 Oct 2026 showed the default branch master, a push on 15 Oct 2026, the homepage https://intelowlproject.github.io, and release v6.8.0 published 31 Aug 2026.

• Observables and files. The README names files plus IP, domain, URL, and hash observables, behind a Django REST API.
• Certego since v6.8.0. The README says management is fully in Certego's hands and links discussion 3654. The tag was published 31 Aug 2026.
• Site claims versus the API. The site says 4K+ stars and 200+ analyzers. The API on 17 Oct 2026 reported 4,761 stars and 693 forks.

1. 1

   Deploy from the repository's Docker instructions. Cite v6.8.0, published 31 Aug 2026, until you move tags.

2. 2

   Read discussion 3654 before you describe who maintains the project.

3. 3

   Open the analyzer output behind a score. Keep the service name and the date in the note.

4. 4

   Use the API star count when you need a figure. Label the website's 200+ analyzers as the site's claim.

• An indicator needs enrichment you can run inside the network. IntelOwl is the AGPL-3.0 framework the README describes: files and observables such as an IP, a domain, a URL, or a hash, through a Django REST API, with pyintelowl as a client library. You deploy it with Docker. Release v6.8.0 was published 31 Aug 2026. The README says that since that version management is fully in Certego's hands and points at discussion 3654. Read that discussion before you describe governance.
• A slide says IntelOwl has 4K stars and 200 analyzers. The project website does print “4K+ Github Stars,” “250k+ Downloads,” “500+ Forks,” and “200+ Analyzers.” On 17 Oct 2026 the GitHub API reported 4,761 stars and 693 forks. Use the API figure when you need a count, and label the analyzer line as the site's claim. This listing did not inventory the analyzers and did not audit the download number.
• The honeynet demo is offered as a picture of a finished job. intelowl.honeynet.org returned a JavaScript application shell on 17 Oct 2026, not a result table. Do not describe a screen you did not open. An analyzer row, once you have one from your own instance, is that service's comment on the observable. Open the raw report and record the service name and the time. A hit is not a verdict, and a miss is not a clean bill of health.

Hard cases

The case where the first result is easy to over-read.

Questions

Titled sources. These public pages are what the quotes on this listing come from.