Who flowsint is for#
Cybersecurity analysts mapping threat actor infrastructure
Connect domains, IPs, ASNs, and email addresses belonging to a threat actor in one graph. Run DNS, WHOIS, subdomain discovery, and IP geolocation enrichers to expand the picture automatically, then compile findings from the graph rather than reassembling them from separate tool outputs.
Skip if:
If your investigation workflow centers on a SIEM or proprietary threat intelligence platform that already imports IOC feeds, Flowsint adds a separate graph layer that may not integrate directly with your existing tooling without custom development.
OSINT researchers tracing cross-platform entity networks
Track an entity across social profiles, domain registrations, organization affiliations, and cryptocurrency wallets in a single graph session. The Maigret enricher runs username searches across social platforms, and the crypto wallet enrichers pull transaction histories and NFT holdings for blockchain addresses.
Skip if:
If your targets are restricted to structured data sources such as API feeds or public databases, a scripted approach without a graph layer is often faster for single-entity lookups where the relationship mapping overhead adds no value.
Investigative journalists tracing financial and organizational connections
Map company-to-domain, individual-to-organization, and domain-to-IP relationships visually. Add new entities by dragging them into the graph and enriching them on demand. Investigation history stays in one place rather than scattered across browser bookmarks and spreadsheets.
Skip if:
Flowsint has no built-in report generator. Journalists who need a structured output format for publication will need a separate reporting step or an n8n workflow that exports graph data into a document format.
Security teams running automated threat monitoring
Connect Flowsint to an n8n workflow to automatically collect and enrich data from new threat indicators as they appear. Route alerts to Slack or Teams when specific indicator patterns emerge in the graph. The server deployment mode makes the shared graph accessible to the full security team without each analyst running a local instance.
Skip if:
STIX 2.x export for sharing intelligence with external partners or loading it into a SIEM is on the roadmap but not yet implemented. Verify the current release before deploying if that integration is a hard requirement.
The problem it solves#
Investigating an unknown entity requires pulling data from many sources: DNS resolvers, WHOIS services, social media lookup tools, breach databases, and ASN registries. Each service returns results in its own format. Analysts end up copying findings between browser tabs and spreadsheets, and the connections between data points get lost as the investigation grows.
Commercial graph tools partially address this with a visual canvas, but they charge per-transform fees that scale with investigation size and store session data on their own infrastructure. For security researchers handling sensitive cases, sending subject data to a third-party commercial service raises legal and operational concerns that many organizations cannot accept. The alternative, a collection of standalone Python scripts, breaks whenever an upstream API changes its schema, and script outputs rarely connect automatically to an existing graph of discovered entities.
How it solves it#
Interactive entity graph canvas
An interactive canvas displays entities (domains, IPs, individuals, organizations, social profiles, cryptocurrency wallets) as nodes and their connections as edges. The graph renders thousands of nodes without lag, and you can expand any entity directly from the canvas to trigger an enrichment run.
Pluggable REST and Python enrichers
Enrichers are simple REST endpoints or Python webhooks you register in Flowsint. The built-in set covers domain resolution, WHOIS, subdomain discovery, IP geolocation, ASN lookup, Maigret username search across social platforms, email breach checks, and cryptocurrency wallet transaction history. Add or replace any enricher without modifying the core graph.
Dynamic entity schemas with type safety
Entities use strongly typed schemas built from customizable field definitions: text, numbers, dates, and nested properties. Schema changes evolve without breaking existing graph data. The type system validates new entity data at insertion, so malformed enricher output does not corrupt the graph.
n8n workflow integration
Flowsint exposes a webhook connector that plugs directly into n8n, giving access to 500+ external services. Use it to set up automated OSINT collection from social media and public databases, trigger Slack or Teams alerts when specific indicators appear in the graph, or generate investigation reports on a schedule.
Self-hosted with encrypted API key storage
All investigation data stays on your server. API keys used by enrichers are stored in an encrypted vault rather than in plaintext config files. Only port 5173 is exposed to the network; PostgreSQL, Neo4j, and Redis all bind to localhost on the host machine, unreachable from outside.
Strengths and trade-offs#
Strengths
- No per-transform or per-seat feesUnlike Maltego, which charges per transform run and gates advanced enrichers behind commercial tiers, Flowsint carries no transaction costs. Apache 2.0 licensed and self-hosted, so the only ongoing cost is your server. Investigation costs do not scale with graph size or the number of enrichers you run.
- Full data ownership on your infrastructureInvestigation data, entity records, and API keys all stay on your machine. No subject data leaves your network to reach a third-party enrichment service. For analysts working on sensitive investigations or under legal constraints about data residency, this is the architecture that makes Flowsint usable where commercial tools are not.
- Broad built-in enricher coverageThe built-in enricher set covers 25+ data sources across domains, IPs, ASNs, social profiles, emails, organizations, and cryptocurrency wallets, with n8n integration extending that reach to 500+ external services. The repository reached 8,341 GitHub stars and 1,028 forks since its January 2025 launch, with active pushes as recently as September 2026.
- Developer-extensible without vendor permissionEnrichers are REST or Python webhook endpoints. Any developer can add a new data source, replace a broken API, or chain enrichers together without waiting for a vendor update. The modular codebase (flowsint-core, flowsint-api, flowsint-enrichers, flowsint-app, flowsint-types) keeps changes isolated.
Trade-offs
- -Early development with incomplete test coverageThe README explicitly states that Flowsint is "still in early development" and that each module's test suite is incomplete. Breakage is more likely on self-hosted upgrades than on a more mature project. Budget time for debugging if you track the latest main branch rather than a pinned version tag.
- -Multi-database self-hosting stackA full deployment requires Docker running PostgreSQL, Neo4j, and Redis simultaneously. Neo4j in particular is memory-intensive and adds operational overhead that typical Docker deployments do not require. Lightweight VPS instances under 2 GB RAM may struggle. The `make prod` command handles initial setup, but you own the ongoing maintenance.
- -STIX 2.x support not yet availableFlowsint's public roadmap lists STIX 2.x (the standard format for cyber threat intelligence sharing) as planned but not implemented. Teams that need to import or export CTI in STIX format for sharing with partners or ingesting into a SIEM will not find that capability in the current release.
flowsint vs alternatives#
Flowsint vs Maltego
Maltego is the dominant commercial graph investigation tool used by corporate security teams and government analysts. Both tools visualize entity relationships through a graph interface, but they differ on cost model, extensibility, and data residency.
| Feature | Flowsint | Maltego |
|---|---|---|
| License | Apache-2.0 | Proprietary |
| Self-hosting | Yes, Docker | No (desktop app with cloud transforms) |
| Enricher model | Open REST/Python webhooks | Commercial transform marketplace |
| Cost | Server costs only | Per-transform fees plus seat licensing |
Flowsint is the better choice when data privacy requirements prevent sending subject information to a third-party service, or when investigation scale makes per-transform fees prohibitive. Maltego is worth considering when your team needs a large existing library of pre-built commercial transforms (ThreatConnect, PassiveTotal, Shodan) without building your own enrichers, and when UI polish and desktop integration matter more than self-hosting.
Flowsint vs IBM i2 Analyst's Notebook
IBM i2 Analyst's Notebook is an enterprise law enforcement and intelligence analysis product. The overlap with Flowsint is the visual entity relationship graph; the target market and deployment model differ substantially.
| Feature | Flowsint | IBM i2 Analyst's Notebook |
|---|---|---|
| License | Apache-2.0 | Proprietary |
| Deployment | Self-hosted Docker | On-premises enterprise install |
| Extension model | Open webhooks | IBM plugin ecosystem |
| Target market | Security analysts, OSINT researchers | Law enforcement, intelligence agencies |
IBM i2 is worth the cost when your organization needs certified integrations with law enforcement databases, case management compliance features, or an enterprise support contract. Flowsint suits independent analysts, security teams, and organizations where IBM i2 licensing costs are not justified and where extending enrichers freely matters more than vendor support.
Flowsint vs Social Links
Social Links is a commercial OSINT enrichment service specializing in social media and identity resolution. It provides a Maltego transform library and a standalone search interface.
| Feature | Flowsint | Social Links |
|---|---|---|
| License | Apache-2.0 | Proprietary SaaS |
| Deployment | Self-hosted | Cloud-managed |
| Social enrichment | Via Maigret (open source) | Proprietary dataset access |
| Graph visualization | Built-in | Via Maltego integration |
Social Links is worth considering when you need high-accuracy social media identity resolution from proprietary datasets not available through open sources. Flowsint's Maigret enricher covers username matching across social platforms using open lookup methods. For teams that need Social Links' proprietary dataset coverage alongside local graph storage, Flowsint can serve as the graph layer with a custom enricher that calls the Social Links API.
Quick start#
Self-hosting uses Docker with PostgreSQL, Neo4j, and Redis; a single Make command handles the full stack on Linux and macOS.
```bash
git clone https://github.com/reconurge/flowsint.git
cd flowsint
make prod
```What it's built on#
- Languages
- JavaScriptPythonTypeScript
- Frameworks
- FastAPIReact
- Databases
- PostgreSQL
- Infrastructure
- Docker
- Cache
- Redis
FAQ#
Is Flowsint free to use?
Yes. Flowsint is Apache 2.0 licensed and entirely self-hosted. There is no cloud tier, no per-transform fee, and no managed service. You run it on your own server and pay only for the hosting infrastructure. The Apache 2.0 license permits commercial internal use with no additional restrictions.
What does Flowsint require to self-host?
Docker is the only hard requirement. On Linux and macOS, a make prod command pulls pre-built images for the full stack: the TypeScript frontend, a FastAPI backend, PostgreSQL, Neo4j (the graph database), and Redis. Windows users run the same Docker Compose file without Make by copying the .env files and running docker compose -f docker-compose.prod.yml up -d. The README recommends rotating the default AUTH_SECRET, MASTER_VAULT_KEY_V1, and NEO4J_PASSWORD values in .env before exposing the server to a network.
Can Flowsint run without internet access?
The core application and local graph database work offline. Individual enrichers that call external APIs (WHOIS services, Maigret, breach databases, IP geolocation) require internet access to function. Investigations already stored in the local graph are accessible and editable without connectivity.
Does Flowsint support custom enrichers?
Yes. Enrichers are REST endpoints or Python webhooks that you write and host, then register in Flowsint. This means you can add any data source you have API access to, including internal databases, paid data providers, or proprietary feeds, without modifying Flowsint's core. The n8n connector also lets you chain Flowsint enrichment with 500+ external services through webhook-based workflows.
How does Flowsint compare to Maltego?
Flowsint is self-hosted and Apache 2.0 licensed; Maltego is a proprietary desktop application with per-transform fees and a managed cloud component. Flowsint's enrichers are open webhook endpoints you write or replace freely; Maltego transforms are distributed through a commercial marketplace. For teams that need data to stay on their own infrastructure and want an enricher model they can extend independently, Flowsint is the better fit. Maltego has a larger library of pre-built commercial transforms for teams that prefer purchasing integrations over building them.
Similar open-source tools#
Local Deep Research
Your AI research assistant, fully local and encrypted.
Maigret
Collect OSINT data by username effortlessly
OpenFlux
TCP tunneling via Yandex Docs or WebRTC transports
FckSignups
Open-source tools that work instantly, no signup required
ship-safe
Security scanner for AI agents, MCP servers, and LLM codebases.
Automated-AI-Web-Researcher-Ollama
Ollama-powered web researcher that breaks queries into focus areas