Threat intelligence CSIRT-led

AIL Framework

Collect and analyse unstructured web, chat and file data to investigate information leaks and extract threat intelligence.

By CIRCL and project contributors · Luxembourg

Open primary source Compare saved tools Report a correction

CSIRT-led

Primary sources connect this project to an EU CSIRT as developer or lead.

At a glance

Recorded facts

Response workflow: Threat intelligence
Developer or maintainer: CIRCL and project contributors
Recorded country: Luxembourg
Product model: Open source
Deployment: Self-hosted
Software license: AGPL-3.0-or-later
Upstream status: Active
Evidence class: CSIRT-led

What the sources establish

Origin note

The upstream README explicitly states that AIL was originally developed at CIRCL, the Computer Incident Response Center Luxembourg.

Reported capabilities

Keyword, regular-expression and YARA tracking with historical hunts.
Extracts indicators and exports findings to MISP.

Scope and limits

Crawlers, feeds and optional analysis services require separate configuration.

Inspect the research evidence 6 source observations

identity / capabilities / deployment
Upstream documentation describes collect and analyse unstructured web, chat and file data to investigate information leaks and extract threat intelligence. It documents local installation.
Read source Checked 2026-10-10
origin / country
The upstream README explicitly states that AIL was originally developed at CIRCL, the Computer Incident Response Center Luxembourg.
Read source Checked 2026-10-10
license
The upstream license file specifies AGPL-3.0-or-later.
Read source Checked 2026-10-10
maintenance
Repository is not archived; its last recorded push was 2026-10-09. This is an activity signal, not a support guarantee.
Read source Checked 2026-10-10
origin / country
CIRCL lists AIL among its open-source projects in Luxembourg.
Read source Checked 2026-10-10
license
The README applies version 3 or any later version to this software.
Read source Checked 2026-10-10

This profile summarizes source material. It does not include hands-on security testing, procurement review, or an assessment of fit for your environment.

Capabilities & integrations

Tags record specific documented functions. They do not establish end-to-end interoperability; check the component, edition and version in the source.

YARA Capability

Uses YARA trackers on collected content and supports retrospective YARA hunts over historical data.

AIL detection and tracking documentation

Support evidence checked 2026-10-11

MISP Integration

Exports AIL objects and investigations in MISP formats, with automatic exports configurable for selected detections and tags.

AIL export and integration documentation

Support evidence checked 2026-10-11

Documented EU funding

Connecting Europe Facility (CEF) · Joint Threat Analysis Network (JTAN)

Reference: 2020-EU-IA-0260

AIL identifies its instance synchronisation protocol, released in version 4.0 in December 2021, as JTAN-funded development. JTAN finished in June 2024.

Funding evidence checked 2026-10-11

Funding can be historical or component-specific. It does not imply EU certification, current funding or endorsement. Explore the funding collection.

Put the tool in context.

Turn a report or indicator into a sourced intelligence record, a detection request and a useful handoff. Practical steps with MISP and OpenCTI references.

A threat intelligence workflow for CSIRTs