Happy First Birthday IntelOwl!

Note: There were some major bugs in this version so we request you to checkout the latest version here instead.

Happy 1st Birthday IntelOwl! The gift is a new major release 🚀

BREAKING CHANGES:

• moved docker and docker-compose files under docker/ folder.
• users upgrading from previous versions need to manually move env_file_app, env_file_postgres and env_file_integrations files under docker/.
• users are to use the new start.py method to build or start IntelOwl containers
• moved the following analyzers together in a specific optional docker container named static_analyzers.
  • Capa
  • PeFrame
  • Strings_Info_Classic (based on flarestrings)
  • Strings_Info_ML (based on stringsifter)

Please see docs to understand how to enable these optional analyzers

NEW INBUILT ANALYZERS:

• added Qiling file analyzer. This is an optional analyzer (see docs to understand how to activate it).
• added Stratosphere blacklists analyzer
• added FireEye Red Team Tool Countermeasures Yara rules analyzer
• added emailrep.io analyzer
• added Triage analyzer for observables (search API)
• added InQuest analyzer
• added WiGLE analyzer
• new analyzers were added to the static_analyzers optional docker container (see docs to understand how to activate it).
  • FireEye Floss strings analysis.
  • Manalyze file analyzer

FIXES/IMPROVEMENTS/Dependency upgrades:

• upgraded main Dockerfile to python 3.8
• added support for the generic observable type. In this way it is possible to build analyzers that can analyze everything and not only IPs, domains, URLs or hashes
• added Multi-queue option to optimize usage of Celery queues. This is intended for advanced users.
• updated GUI to new IntelOwl-ng version
• upgraded Speakeasy, Quark-Engine and Dnstwist analyzers to last versions
• moved from Travis CI to Github CI
• added CodeCov coverage support (so we will be improving the test coverage shortly)
• moved PEFile library pointer to a forked pip repo that contains some fixes.
• fix to log directiories that could result in some optional analyzers to break
• added milliseconds to logs