Orion Platform is a comprehensive, web-based solution that combines the functionality of a browser, search engine, crawler, and data aggregation tools to empower OSINT (Open Source Intelligence) experts. Built on top of Docker, Orion provides a user-friendly interface to explore, search, and visualize data extracted by its powerful Orion Crawler.
The platform integrates seamlessly with machine learning models, enhancing search relevance and enabling advanced
content analysis. Orion supports a broad range of functionalities, including the ability to search, filter, and
visualize data across multiple categories, making it an invaluable tool for data exploration and intelligence
gathering.
Designed with flexibility and scalability in mind, Orion enables OSINT experts to feed data directly into the platform,
ensuring up-to-date and comprehensive datasets. Whether for investigative research, competitive analysis, or general
information gathering, Orion provides a unified ecosystem that enhances the workflow of professionals who rely on
actionable insights.
- Git and a Bash-compatible shell.
- Docker Engine with Docker Compose v2 (
docker compose). - A Node.js version matching
^20.19.0,^22.12.0, or>=24.0.0, with npm. - OpenSSL and
rsync, used by the local build script.
Install and configure · build and run Orion locally
git clone https://github.com/Orion-Intelligence/Orion-Intelligence.git
cd Orion-Intelligence
cp template-env .envOpen .env and replace every placeholder credential before starting the platform. Generate independent application
keys with:
openssl rand -hex 32
openssl rand -base64 32 | tr '+/' '-_'Use the first value for JWT_SECRET_KEY and the second for ENCRYPTION_KEY. The .env file is ignored by Git and must
never be committed.
chmod +x run.sh
./run.sh build -dAfter the services become healthy, open http://127.0.0.1:8080. Local HTTPS is also available
at https://127.0.0.1:8443 with a generated self-signed certificate.
For later starts or shutdowns:
./run.sh
./run.sh stopFor additional build modes, testing workflows, production deployment, and configuration details, see the developer documentation or the complete Orion documentation.
The Orion homepage provides a search-first investigation workspace with summary panels, recent findings, and visual pivots that help analysts move quickly from overview to deeper investigation.
Homepage Overview · Search, intelligence summaries, activity, and geographic context
Screenshot Gallery · Browse 43 platform screens
 Account Settings |
 APK Scan Report |
 Audit Logs |
 Consolidated Insights |
 Consolidated Results |
 CTI Context Menu |
 CTI Export Modal |
 CTI Graph |
 Data Breach Tracking |
 Defacement Report |
 Directory Monitoring |
 Entity API Email Breach |
 Exploit Results |
 Feed Report |
 File Scanner Report |
 General Intelligence Results |
 Heatmap Report |
 Homepage Overview |
 Homepage Searchbar |
 Login Page |
 Network Intel Geo Modal |
 Network Intel Host Recon |
 Network Intel IP Scan |
 Network Intel Vulnerability Scan |
 Password Reset |
 Report Chatbot |
 Report JSON Viewer |
 Search Filters |
 Social Intel List View |
 Social Intel |
 Social Manage Profiles |
 Social Metadata Results |
 Social Report |
 Social Summary Popup |
 Stealer Logs Results |
 Support Modal |
 System Settings |
 Tenant Administration |
 Tenant Homepage |
 Tenant Manage IOCs |
 Tenant Settings |
 Tenant Users |
 Web Scan Report |
||
Orion is built as an operational intelligence environment rather than a single search page. Its capabilities span the complete path from collection to analyst action.
- Collect and ingest intelligence from multiple sources.
- Normalize collected data and enrich it with investigation-ready context.
- Index and retrieve large investigative datasets through purpose-built search services.
- Search, filter, correlate, visualize, and review intelligence in one analyst environment.
- Extend the ecosystem as new collection sources and investigative needs emerge.
Orion is intended for OSINT analysts, research teams, cyber threat investigators, and platform operators who need a unified environment for collection, search, enrichment, correlation, and review workflows.
| Area | Current position |
|---|---|
| Development status | Actively developed on the trusted-main branch. |
| Supported deployment | Docker Compose for local and development environments, with a dedicated production Compose configuration. |
| Release policy | Versioned Git tags identify release snapshots. trusted-main contains current development, and releases follow validation rather than a fixed public cadence. |
| Documentation | Use the Orion documentation for platform usage, configuration, and API guidance. |
| Bugs and feature requests | Use GitHub Issues for reproducible bugs and feature proposals that contain no sensitive information. |
| Operational help | Use the in-platform Help & Support workflow or the collaboration page for non-security questions. |
| Security reports | Follow the Security Policy and report vulnerabilities privately. |
The Orion ecosystem is composed of connected repositories and services that support the full intelligence lifecycle. Individual modules focus on collection, storage, supporting services, the analyst experience, browser-assisted acquisition, and specialized social-data workflows.
Orion follows a clear path from source collection to analyst action:
The five primary modules are shown first. Expand the additional modules to view the rest of the ecosystem.
| Module | Role in the ecosystem | Core technologies |
|---|---|---|
| Analyst experience and project access | ||
| Orion Platform PUBLIC REPOSITORY |
Unified analyst workspace for search, investigation, correlation, visualization, cases, alerts, and administration. |      |
| Orion Landing ECOSYSTEM SERVICE |
Public-facing product site for capability discovery, project orientation, and access to the Orion ecosystem. |     |
| Investigation, collection, and enrichment | ||
| Orion Dark Nexus ECOSYSTEM SERVICE |
AI-assisted investigation, chat orchestration, tool integration, and secure workspace management. |     |
| Orion Crawler ECOSYSTEM SERVICE |
Scheduled crawling across hidden-web and monitored sources, with distributed task execution and private-network routing. |     |
| Orion Collector ECOSYSTEM SERVICE |
Extensible source-collection framework for targeted acquisition and custom ingestion workflows. |  |
Show 6 more modules · Social, Browser, Micros, Sandbox, Leaks, and Tor2Web
| Module | Role in the ecosystem | Core technologies |
|---|---|---|
| Collection and enrichment | ||
| Orion Social ECOSYSTEM SERVICE |
Social-intelligence collection and enrichment service with browser automation and isolated Tor-assisted crawling. | |
| Orion Browser ECOSYSTEM SERVICE |
Private, browser-assisted acquisition workflows for mobile investigators. |      |
| Platform services and secure access | ||
| Orion Micros ECOSYSTEM SERVICE |
Shared analysis, validation, privacy, malware-scanning, and security-testing services. |    |
| Orion Sandbox ECOSYSTEM SERVICE |
Isolated execution infrastructure for untrusted investigation and AI-workspace code. |   |
| Orion Leaks ECOSYSTEM SERVICE |
Secure whistleblowing and report-intake portal based on the GlobaLeaks platform. |  |
| Orion Tor2Web ECOSYSTEM SERVICE |
Controlled Tor-to-web access layer for browser-compatible access to onion resources. |   |
We welcome contributions to improve Orion Platform. If you'd like to contribute, please fork the repository and submit a pull request.
- Fork the repository.
- Create a new feature branch (
git checkout -b feature-branch). - Commit your changes (
git commit -m 'Add some feature'). - Push to the branch (
git push origin feature-branch). - Create a new Pull Request.
Orion Platform is licensed under the MIT License.
This project is intended for research purposes only. The authors of Orion Platform do not support or endorse illegal activities, and users of this project are responsible for ensuring their actions comply with the law.
Please report suspected vulnerabilities privately according to the Orion Security Policy. Do not open a public issue for a security vulnerability.
Explore collaboration opportunities and platform documentation.
