Skip to content


The User Guide provides information on how to use installed IntelMQ and it's components. Let's start with a basic not-so-technical description of how IntelMQ works and the used terminology:

  • It consists of small (python) programs called bots.
  • Bots communicate witch each other (using something called message broker) by passing so called events (JSON objects).
  • An example event can look like this:
    "": "JO",
    "": "qakbot",
    "source.ip": "",
    "source.asn": 47887,
    "classification.type": "c2-server",
    "extra.status": "offline",
    "source.port": 443,
    "classification.taxonomy": "malicious-code",
    "source.geolocation.latitude": 31.9522,
    "feed.accuracy": 100,
    "extra.last_online": "2023-02-16",
    "time.observation": "2023-02-16T09:55:12+00:00",
    "": "amman",
    "": "",
    "time.source": "2023-02-15T14:19:09+00:00",
    "source.as_name": "NEU-AS",
    "source.geolocation.longitude": 35.939,
    "": "abusech-feodo-c2-tracker"
  • Bots are divided into following groups:

    • Collectors - bots that collect data from sources such as website, mailbox, api, etc.
    • Parsers - bots that split and parse collected data into individual events.
    • Experts - bots that can do additional processing of events such as enriching, filtering, etc.
    • Outputs - bots that can output events to files, databases, etc.
  • Data sources supported by IntelMQ are called feeds.

    • IntelMQ provides recommended configuration of collector and parser bot combinations for selected feeds.
  • The collection of all configured bots and their communication paths is called pipeline (or botnet).
  • Individual bots as well as the complete pipeline can be configured, managed and monitored via:
    • Web interface called IntelMQ Manager (best suited for regular users).
    • Command line tool called intelmqctl (best suited for administrators).
    • REST API provided by the IntelMQ API extension (best suited for other programs).