IntelOwl: Integrating a Self-Deployed LLM Chatbot for Threat Intelligence

This project aims to transform how analysts interact with threat intelligence data in IntelOwl by introducing a conversational AI interface. Currently, analysts must manually navigate dashboards, query APIs, and correlate results across different jobs and investigations. To solve this, I will integrate a privacy-preserving, self-hosted LLM chatbot using Ollama and a LangChain ReAct agent. The agent will be equipped with custom tools to query IntelOwl's internal REST API using natural language. Key deliverables include: 1) A new Django chatbot app handling WebSocket connections via Django Channels for real-time token streaming. 2) Ollama Docker integration with CPU/GPU auto-detection. 3) A native React chat component embedded in the existing frontend. 4) Custom LLM tools for triggering analyses and searching data models. 5) Comprehensive test coverage and detailed documentation for users and future maintainers.