Skip to content

Home

Jump to bottom
galmx edited this page May 22, 2026 · 1 revision

NEXUSINTEL

Cyber Investigation • Infrastructure Correlation • Threat Intelligence


Platform Backend Frontend License Status

Overview

NexusIntel is an enterprise-style cyber investigation and intelligence platform built for modern analysts, researchers, SOC teams, and infrastructure investigators.

The platform is designed to transform fragmented intelligence into structured investigations through:

  • relationship mapping
  • infrastructure correlation
  • graph analysis
  • enrichment pipelines
  • evidence management
  • investigation timelines
  • analyst workspaces

Unlike traditional OSINT utilities or standalone scanners, NexusIntel focuses on investigative workflows and infrastructure relationships at scale.

Core Capabilities

Investigation Workspace

  • Persistent investigation cases
  • Analyst activity tracking
  • Tagged findings
  • Timeline reconstruction
  • Evidence organization
  • Multi-session workflows

Infrastructure Correlation

  • Domain analysis
  • ASN intelligence
  • Reverse DNS mapping
  • TLS certificate pivots
  • Shared infrastructure discovery
  • Relationship scoring

Graph Intelligence

  • Interactive node graphs
  • Pivot visualization
  • Cluster analysis
  • Infrastructure mapping
  • Dynamic filtering
  • Exportable relationships

Threat Intelligence

  • AbuseIPDB
  • Shodan
  • VirusTotal
  • GreyNoise
  • OTX
  • Censys integrations

Platform Modules

Graph Engine

The NexusIntel graph engine enables investigators to visualize relationships between:

Domains
IP Addresses
ASNs
TLS Certificates
Usernames
Hashes
Technologies
Organizations
Infrastructure Clusters

Supports:

  • drag-and-drop interaction
  • animated pivots
  • clustering
  • filtering
  • node scoring
  • relationship confidence levels

Evidence System

Centralized evidence storage supporting:

  • screenshots
  • logs
  • JSON evidence
  • analyst notes
  • timeline references
  • metadata indexing

Each evidence object is automatically associated with:

  • timestamps
  • SHA256 hashes
  • investigation cases
  • analyst attribution

Intelligence Enrichment

NexusIntel supports modular enrichment pipelines for:

  • IP intelligence
  • domain intelligence
  • ASN correlation
  • technology fingerprinting
  • passive DNS
  • geolocation
  • infrastructure profiling

API integrations are optional and securely loaded using environment variables.

Architecture

Frontend
 ├── React
 ├── TailwindCSS
 ├── Framer Motion
 ├── Cytoscape.js
 └── Zustand

Backend
 ├── FastAPI
 ├── SQLAlchemy
 ├── AsyncIO
 ├── Pydantic
 └── Modular Services

Database
 ├── SQLite
 └── PostgreSQL

Deployment
 ├── Docker
 ├── Docker Compose
 └── Linux VPS Ready

Repository Structure

nexusintel/
│
├── frontend/
├── backend/
│   ├── api/
│   ├── enrichers/
│   ├── intelligence/
│   ├── graph/
│   ├── evidence/
│   ├── reports/
│   ├── database/
│   └── workers/
│
├── docker/
├── docs/
├── screenshots/
├── scripts/
└── .github/

Features

Investigation Timelines

Track:

  • enrichment activity
  • infrastructure changes
  • analyst actions
  • evidence uploads
  • relationship pivots

Campaign Clustering

Detect related infrastructure using:

  • shared certificates
  • ASN overlap
  • favicon hashes
  • hosting providers
  • DNS reuse
  • TLS fingerprints

Investigation Replay

Replay pivot chains and analyst workflows visually.

Infrastructure Heatmaps

Global visualization of infrastructure relationships and investigation clusters.

Quick Start

Clone Repository

git clone https://github.com/xdrew87/nexusintel.git
cd nexusintel

Backend Setup

cd backend

python -m venv venv

# Linux/macOS
source venv/bin/activate

# Windows
venv\Scripts\activate

pip install -r requirements.txt

uvicorn main:app --reload

Frontend Setup

cd frontend

npm install
npm run dev

Docker Deployment

docker-compose up --build

Security

NexusIntel is intended strictly for:

  • authorized investigations
  • defensive security operations
  • threat intelligence analysis
  • infrastructure research
  • OSINT workflows

Users are responsible for ensuring compliance with:

  • local laws
  • provider policies
  • platform terms
  • responsible disclosure standards

Roadmap

  • Autonomous pivot engine
  • Live collaboration
  • Multi-tenant workspaces
  • Threat feed ingestion
  • Sigma rule exports
  • Infrastructure scoring engine
  • AI-assisted investigation workflows
  • PCAP correlation support
  • Investigation snapshots
  • Real-time graph synchronization

Contributing

Contributions, feature requests, and issue reports are welcome.

Please review:

  • CONTRIBUTING.md
  • SECURITY.md
  • CODE_OF_CONDUCT.md

before submitting pull requests.

License

MIT License © xdrew87

NexusIntel

Investigate • Correlate • Visualize

Clone this wiki locally