guardianvigil/intelstack repository overview

⁠IntelStack - Enterprise Threat Intelligence Platform

IntelStack is an advanced threat intelligence and security analysis platform by GuardianVigil that empowers security teams with comprehensive threat detection, analysis, and response capabilities.

⁠🎯 Why IntelStack?

• Unified Threat Intelligence: Consolidate multiple security feeds into a single, actionable platform
• Time & Resource Efficiency: Reduce investigation time by up to 60% with automated analysis
• Cost-Effective: Single platform for multiple security services, reducing subscription costs
• Enterprise-Ready: Built for scale with multi-user support and role-based access
• Automated Analysis: Reduce manual effort with automated threat correlation
• Compliance Ready: Built-in reporting for security compliance requirements

⁠🎓 Use Cases

⁠Security Operations

• Rapid threat investigation and response
• Automated IOC enrichment
• Real-time threat monitoring
• Incident response automation

⁠Threat Intelligence

• Malware analysis and classification
• Domain and URL reputation checking
• IP address investigation
• File hash verification

⁠Compliance & Reporting

• Automated compliance reporting
• Threat intelligence feeds
• Custom report generation
• Audit trail maintenance

⁠🚀 Core Features

⁠Analysis Capabilities

• Hash Analysis
  • File reputation checking
  • Malware detection
  • YARA rules support
  • Cross-platform verification
• IP Analysis
  • Reputation assessment
  • Threat intelligence correlation
  • Geographic tracking
  • Network behavior analysis
• URL & Domain Analysis
  • Real-time scanning
  • Screenshot capture
  • SSL certificate validation
  • Domain reputation tracking

⁠Security Features

• Advanced API Management

  • Encrypted storage using Fernet
  • Per-user API key isolation
  • Automatic key rotation
  • Usage monitoring and quotas

• Platform Security

  • Multi-level caching strategy
  • Rate limiting protection
  • Cross-site request forgery protection
  • Secure data transmission

⁠Monitoring & Reporting

• Real-time Monitoring

  • Live threat detection
  • Automated alerts
  • Customizable dashboards
  • Performance metrics

• Comprehensive Reporting

  • Standardized report formats
  • Visual data representation
  • Export capabilities
  • Scheduled reporting

⁠📋 Prerequisites

⁠System Requirements

• CPU: 2+ cores recommended
• RAM: 4GB minimum, 8GB recommended
• Storage: 20GB minimum
• OS: Linux (recommended), Windows, macOS

⁠Software Requirements

• Python 3.8+
• Redis Server 6.0+
• PostgreSQL 12+ (recommended)
• Node.js 14+ and npm

⁠🔧 Quick Start

1. System Preparation:

   # Linux (Ubuntu/Debian)
   sudo apt update
   sudo apt install python3.8 python3.8-venv redis-server postgresql
   
   # Windows
   # Install Python, Redis, and PostgreSQL manually
   

   Copy

2. Clone & Install:

   git clone https://github.com/GuardianVigil/IntelStack.git
   cd IntelStack
   python setup.py
   

   Copy

3. Start the Platform:

   python run.py
   # Access the platform at http://localhost:8000
   

   Copy

⁠🎮 Getting Started

1. Initial Setup:

   • Log in to admin panel at /admin
   • Configure API keys in Settings
   • Set up user accounts and permissions

2. Basic Operations:

   • Start with the Dashboard for overview
   • Use Quick Scan for rapid threat checks
   • Configure automated alerts
   • Set up custom reports

3. Advanced Features:

   • Create custom analysis workflows
   • Set up automated response rules
   • Configure integration webhooks
   • Customize threat scoring

⁠🔌 API Integration

import requests

API_KEY = 'your_api_key'
BASE_URL = 'http://your-intelstack-instance/api/v1'

# Quick threat check
response = requests.post(f'{BASE_URL}/analyze', 
    headers={'Authorization': f'Bearer {API_KEY}'},
    json={'indicator': 'example.com', 'type': 'domain'}
)

⁠🔐 Environment Variables

Create a .env file in the root directory with the following variables:

DEBUG=True
SECRET_KEY=your-secret-key
DATABASE_URL=postgresql://user:password@localhost:5432/dbname
REDIS_URL=redis://localhost:6379/0
ENCRYPTION_KEY=your-encryption-key

⁠🏗️ Architecture

IntelStack/
├── core/              # Core platform functionality
├── analyzers/         # Threat analysis modules
├── integrations/      # Service integrations
├── api/              # REST API endpoints
└── ui/               # Web interface

⁠📈 Performance Optimization

• Redis caching for API responses
• Async processing for heavy tasks
• Rate limiting per API key
• Automatic cache cleanup
• Query optimization

⁠🛡️ Security Considerations

• API keys use AES-256 encryption
• Rate limiting prevents abuse
• CSRF protection enabled
• Regular security updates
• Audit logging enabled

⁠🔍 Troubleshooting

Common issues and solutions:

• Redis Connection: Check Redis service status
• API Timeouts: Verify rate limits
• Slow Analysis: Check system resources
• DB Issues: Verify PostgreSQL connection

⁠🤝 Contributing

1. Fork the repository
2. Create your feature branch (git checkout -b feature/AmazingFeature)
3. Commit your changes (git commit -m 'Add some AmazingFeature')
4. Push to the branch (git push origin feature/AmazingFeature)
5. Create a Pull Request at https://github.com/GuardianVigil/IntelStack/pulls⁠

⁠📝 License

This project is licensed under the MIT License - see the LICENSE⁠ file for details.

⁠🙏 Acknowledgments

• Django⁠
• TailwindCSS⁠
• All the integrated security service providers

⁠📞 Support

For support:

• Open an issue at: https://github.com/GuardianVigil/IntelStack/issues⁠

⁠🐳 Docker Installation

IntelStack is available as a Docker image for easy deployment. You can either pull the pre-built image from Docker Hub or build it yourself.

⁠Option 1: Pull from Docker Hub

# Pull the image
docker pull guardianvigil/intelstack:latest

# Run the container
docker run -d -p 8000:8000 \
  -e SECRET_KEY=your_secret_key \
  -e DJANGO_SUPERUSER_USERNAME=admin \
  -e [email protected] \
  -e DJANGO_SUPERUSER_PASSWORD=your_password \
  guardianvigil/intelstack:latest

⁠Option 2: Build Locally

1. Clone the repository:

git clone https://github.com/GuardianVigil/IntelStack.git
cd IntelStack

1. Build and run using Docker Compose:

cd Docker
docker-compose up -d --build

⁠Environment Variables

The following environment variables can be configured:

• DEBUG: Set to False in production (default: False)
• SECRET_KEY: Django secret key
• DJANGO_SETTINGS_MODULE: Django settings module (default: vristo.settings)
• REDIS_HOST: Redis host (default: localhost)
• REDIS_PORT: Redis port (default: 6379)
• REDIS_DB: Redis database number (default: 0)
• DJANGO_SUPERUSER_USERNAME: Admin username
• DJANGO_SUPERUSER_EMAIL: Admin email
• DJANGO_SUPERUSER_PASSWORD: Admin password

⁠Volumes

The container uses the following volumes:

• /app/storage: For persistent storage
• /app/staticfiles: For static files

⁠Accessing the Application

Once running, access the application at:

• Web Interface: http://localhost:8000
• Admin Interface: http://localhost:8000/admin

⁠Docker Hub Repository

The official Docker image is available at: guardianvigil/intelstack⁠