A modular Python tool that collects threat intelligence from multiple sources for files identified by their hash.
Fileintel is a modular Python application that collects threat intelligence about files by querying multiple security sources using file hashes. It helps security professionals determine if a file is malicious by aggregating data from services like VirusTotal, NSRL, and OTX. The tool outputs results in CSV format for easy analysis and integration into other systems.
Security analysts, incident responders, and forensic investigators who need to quickly assess file reputations during security incidents or malware analysis.
Developers choose Fileintel for its modular design, which allows easy addition of new intelligence sources, and its practical CSV output that integrates seamlessly with existing analysis tools and workflows.
A modular Python application to pull intelligence about malicious files
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The architecture allows easy addition of new sources, as highlighted in the README's emphasis on modularity, enabling customization without core changes.
Pulls data from multiple platforms like VirusTotal and OTX, providing a comprehensive threat view from a single tool, per the key features list.
Outputs results in CSV format to STDOUT, facilitating seamless import into spreadsheets or databases, as described in the project summary.
Supports MD5, SHA1, and SHA256 hashes for file identification, covering common methods used in security investigations.
Can use 7Zip for faster NSRL database processing, improving efficiency for large datasets, as noted in the performance options section.
Requires manual configuration of API keys, installation of Python dependencies from GitHub, and optional 7Zip setup, making deployment non-trivial and error-prone.
The README warns that the script can run for a very long time due to network I/O and API rate limits, hindering rapid analysis in time-sensitive scenarios.
Only accepts file hashes as input, lacking support for file uploads or advanced analysis like sandboxing, which restricts its use to pre-computed hashes.
Relies on external resources, a video, and scattered notes rather than comprehensive built-in docs, increasing the learning curve for new users.