Introduction
IntelMQ is a solution for IT security teams (CERTs & CSIRTs, SOCs abuse departments, etc.) for collecting and processing security feeds (such as log files) using a message queuing protocol. It's a community driven initiative called IHAP1 (Incident Handling Automation Project) which was conceptually designed by European CERTs/CSIRTs during several InfoSec events. Its main goal is to give to incident responders an easy way to collect & process threat intelligence thus improving the incident handling processes of CERTs.
IntelMQ is frequently used for:
- automated incident handling
- situational awareness
- automated notifications
- as data collector for other tools
- and more!
The design was influenced by AbuseHelper however it was re-written from scratch and aims at:
- Reducing the complexity of system administration
- Reducing the complexity of writing new bots for new data feeds
- Reducing the probability of events lost in all process with persistence functionality (even system crash)
- Use and improve the existing Data Harmonization Ontology
- Use JSON format for all messages
- Provide easy way to store data into databases and log collectors such as PostgreSQL, Elasticsearch and Splunk
- Provide easy way to create your own black-lists
- Provide easy communication with other systems via HTTP RESTful API
It follows the following basic meta-guidelines:
- Don't break simplicity - KISS
- Keep it open source - forever
- Strive for perfection while keeping a deadline
- Reduce complexity/avoid feature bloat
- Embrace unit testing
- Code readability: test with inexperienced programmers
- Communicate clearly
Contribute
- Subscribe to the IntelMQ Developers mailing list and engage in discussions
- Report any errors and suggest improvements via issues
- Read the Developer Guide and open a pull request
2 maintainers
Metadata
2 maintainers
Release files for intelmq 3.5.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| intelmq-3.5.0.tar.gz | 2.6 MB | Without provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| intelmq-3.5.0-py2.py3-none-any.whl | Python 3, Python 2 | none | any | Details |
Total release size: 3.6 MB
Release files / intelmq-3.5.0.tar.gz
| Download URL | intelmq-3.5.0.tar.gz |
|---|---|
| Size | 2.6 MB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
09e143c3f2fd5d9ce3e00806f5f3e5b79140ad487e85765a75944acf9415d373
|
|
BLAKE2b-256 checksum How to use checksums |
a493589e95053af073b2a4612cc7c088e1fb7f49b73373d83228f76dd8951a4c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.9
|
Release files / intelmq-3.5.0-py2.py3-none-any.whl
| Download URL | intelmq-3.5.0-py2.py3-none-any.whl |
|---|---|
| Size | 1.0 MB |
| Tags | Python 2 Python 3 |
|
SHA-256 checksum How to use checksums |
38a780143798f38b178b48667d3727aff014880a29dac5335189d80db68b2046
|
|
BLAKE2b-256 checksum How to use checksums |
b08d3dabc3900693ef1f6a51a64dbba5c8917d58985ec102cd4c15225d798459
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
No |
| Uploaded via |
twine/6.2.0 CPython/3.13.9
|
Security for intelmq 3.5.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
No provenance found
None of the files in this release were uploaded with provenance metadata.
A note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
