Estorides — OSINT Platform

E.S.T.E.R.O.I.D.E.S. (acronym)

• E — Entities (identification of entities, aliases, emails, IPs).
• S — Signals (capture of digital footprints and metadata).
• T — Targeted (focused on specific objectives).
• E — Extraction (automated extraction from web sources).
• R — Reconnaissance (recon and footprinting).
• O — Open-source (the nature of the OSINT engine).
• I — Intelligence (processing and correlation of data).
• D — Data (massive ingestion of unstructured records).
• E — Engine (the central engine that orchestrates queries).
• S — Scraper (automated and persistent collection).

From the creators of LazyOwn Redteam Framework comes a free and open-source intelligence (OSINT) aggregator and correlation engine inspired by Palantir, Bellingcat, Maltego, and Citizen Lab workflows. A pure open-source re-imagining of the original fucklantir / osint_palantir toolchain, with a much bigger source catalogue, a proper knowledge graph, structured parsers, and a multi-backend LLM analyst.

No payloads. No active scanning. Just 99+ free public OSINT sources, fanned out in parallel, fused into a single intelligence picture.

                       +--------------------------+
   query "example.com" |  Estorides Orchestrator  |   -> STIX 2.1 bundle
---------------------> |  - async fanout          |   -> MISP event JSON
                       |  - 99+ free sources      |   -> GraphML for Gephi
                       |  - structured parsers    |   -> JSONL for training
                       |  - entity resolution     |
                       |  - knowledge graph       |
                       |  - ontology engine       |   <- OFAC SDN cross-check
                       |  - MITRE ATT&CK mapper   |   <- technique auto-tagging
                       |  - SSRF guard            |   <- blocklist at egress
                       |  - audit log + RL        |   <- per-IP trail
                       |  - multi-LLM analyst     |   <- BLUF / tactical / system
                       +--------------------------+
                                 |
                                 v
                           Web UI: map / graph / bundles / timeline / results

Install

pip install estorides

Run

estorides serve --port 5050

(From a source checkout the equivalent is python3 estorides_cli.py serve --port 5050 or python3 -m estorides_cli serve --port 5050.)

Architecture highlights (state-level)

Estorides is structured around small, single-responsibility registries so adding a new source, backend, inferer, or feed never requires touching the central orchestrator. The five plug-in surfaces are:

Surface	Decorator	File	Used for
Source parsers	@register_parser("name")	estorides_core/parsers.py	Translate raw HTTP into structured dicts
LLM backends	@register("name")	estorides_llm/manager.py	Add an LLM provider (ollama, openai, …)
Relationship inferers	@register_inferer("source")	estorides_core/relationship_inference.py	Source -> graph edges
Real-time feeds	subclass Feed	estorides_core/feeds.py	Map layers (quakes, fires, news, aircraft, satellites, launches)
Encrypted exporters	estorides_export.encryption	estorides_export/encryption.py	STIX/MISP + age encryption

What you get that the original does not

Capability	Original	Estorides
Number of free OSINT sources	~20	99
Intelligence categories	6	12
HTTP fanout model	sequential	async
Retries + backoff + circuit breaker	basic	yes
Response cache (SQLite)	none	yes
Per-source parsers	none	50+
Entity extraction (IP, domain, CVE…)	regex only	structured + dedup
Knowledge graph	none	NetworkX + GraphML
STIX 2.1 / MISP export	none	yes
Multi-LLM (Ollama / OpenAI / Anthropic)	Ollama only	4 backends + stub
Map (geolocation results)	PyVista 3D	Leaflet 2D
Force-directed graph view	none	D3.js
API key handling	none	per-source env vars
Paid source support	none	flag-based opt-in
OFAC SDN sanctions cross-check	none	ontology engine
MITRE ATT&CK technique auto-tagging	none	~40 techniques
SSRF / private-NW egress guard	none	RFC1918 + cloud IMDS blocked
Audit log (per request, append-only)	none	JSONL with IP+query+latency
Per-IP rate limit (sliding window)	none	default 30/min, env-tunable
Encrypted export (age)	none	opt-in via ?key=age1…
Real-time feed layers	none	earthquakes + fires + news
Encrypted export (age)	none	opt-in via ?key=age1…

What v1.1 adds on top

Capability	v1.0	v1.1 (this)
Persistent graph (Cypher queries)	NetworkX dump	Kùzu embedded DB, cross-run joins
Run persistence	JSONL append	SQLite cases with FK observations/entities
Cross-feed entity resolver	none	Wikidata + OFAC + IP-API + NVD via intel_resolver
Fuzzy entity clustering	exact dedup	difflib SequenceMatcher, 0.85 threshold, aliases surfaced
Extra OSINT endpoints (keyless)	99 YAML sources	+7 (BGP, MAC, phone, GitHub, leaks, CISA KEV, malware C2)
Read-only Cypher endpoint	none	/api/intel/graph?q=... with write-keyword guard
Case history UI	none	Cases tab + full-entity inspector

What the data→information pipeline adds (v1.4)

The original engine was a data collector: a fan-out, parsers, a graph, an LLM that summarises. The v1.4 sprint introduces the information layer: every observation now carries a grounded confidence score; the orchestrator and downstream consumers (hypothesis engine, change detection, LLM analyst) stop using their own ad-hoc heuristics and use this single source of truth.