Skip to content


The complete IntelMQ universe consists of the following components:

  • IntelMQ
  • IntelMQ API
  • IntelMQ Manager
  • additional tools
  • useful scripts


This project contains the core functionality.

The Core includes all the components required for processing data feeds. This includes the bots, configuration, pipeline, the internal data format, management tools etc.

Repository: IntelMQ


This is an extension of IntelMQ providing hug based REST API for remote management.

Repository: IntelMQ API

IntelMQ Manager

The Manager is the most known software and can be seen as the face of IntelMQ. It's goal is to provide an intuitive web interface to allow non-programmers to specify the data flow in IntelMQ.

Repository: IntelMQ Manager

IntelMQ Manager Landing page

Additional tools

Here you can find a list of additional tools. If you think something is missing, please let us know!

Unless stated otherwise, the tools are maintained by the IntelMQ community.

IntelMQ Webinput CSV

A web-based interface to ingest CSV data into IntelMQ with on-line validation and live feedback.

This interface allows inserting "one-shot" data feeds into IntelMQ without the need to configure bots in IntelMQ.

Developed and maintained by

Repository: intelmq-webinput-csv

IntelMQ Webinput CSV Preview page

IntelMQ Mailgen

A solution allowing an IntelMQ setup with a complex contact database, managed by a web interface and sending out aggregated email reports. In different words: To send grouped notifications to network owners using SMTP.

Developed and maintained by Intevation, initially funded by BSI.

It consists of the following three components, which can also be used on their own.

IntelMQ CertBUND Contact

The certbund-contact consists of two IntelMQ expert bots, which fetch and process the information from the contact database, and scripts to import RIPE data into the contact database. Based on user-defined rules, the experts determine to which contact the event is to be sent to, and which e-mail template and attachment format to use.

Repository: intelmq-certbund-contact

IntelMQ Fody

Fody is a web based interface for Mailgen. It allows to read and edit contacts, query sent mails (tickets) and call up data from the PostgreSQL database.

It can also be used to just query the database without using Mailgen.

IntelMQ Fody Dashboard

Repository: intelmq-fody

Repository: intelmq-fody-backend


Sends emails with grouped event data to the contacts determined by the certbund-contact. Mails can be encrypted with PGP.

Repository: intelmq-mailgen

"Constituency Portal" tuency

A web application helping CERTs to enable members of their constituency to self-administrate how they get warnings related to their network objects (IP addresses, IP ranges, autonomous systems, domains). tuency is developed by Intevation for

If features organizational hierarchies, contact roles, self-administration and network objects per organization (Autonomous systems, network ranges, (sub)domains, RIPE organization handles). A network object claiming and approval process prevents abuse. An hierarchical rule-system on the network objects allow fine-grained settings. The tagging system for contacts and organization complement the contact-management features of the portal. Authentication is based on keycloak, which enables the re-use of the user accounts in the portal. The integrated API enables IntelMQ to query the portal for the right abuse contact and notification settings with the expert bot.

Tuency Netobjects Overview

Repository: tuency

"Constituency Portal" do-portal (deprecated)


The do-portal is deprecated and succeeded by tuency.

A contact portal with organizational hierarchies, role functionality and network objects based on RIPE, allows self-administration by the contacts. Can be queried from IntelMQ and integrates the stats-portal.

Originally developed by CERT-EU, then adapted by

Repository: do-portal

Stats Portal

A Grafana-based statistics portal for the eventdb{.interpreted-text role="doc"}. Can be integrated into do-portal. It uses aggregated data to serve statistical data quickly.

Stats Portal Architecture

Repository: stats-portal

Malware Name Mapping

A mapping for malware names of different feeds with different names to a common family name.

Repository: malware_name_mapping


A repository with tools for IntelMQ docker instance.

Developed and maintained by

Repository: intelmq-docker

Useful scripts

The list of useful scripts contributed to the IntelMQ universe can be found in the main repository.

Repository: intelmq/contrib