Taranis AI

Taranis AI is an advanced Open-Source Intelligence (OSINT) platform developed by AIT (Austrian Institute of Technology) and co-financed by the Connecting Europe Facility of the European Union. It leverages Artificial Intelligence and Natural Language Processing to automate the collection of unstructured news articles from diverse sources and transform them into structured intelligence reports. Released under the European Union Public Licence 1.2 (EUPL-1.2), the project is actively maintained on GitHub with over 1,190 stars and 173 forks as of mid-2026.

What It Is

Taranis AI is a cybersecurity-focused OSINT workflow platform that covers the full intelligence lifecycle: collecting raw data from web sources, enriching it with AI, enabling analyst review, generating structured reports, and publishing finished intelligence products in formats such as HTML, JSON, PDF, or plain text. It is inspired by earlier projects Taranis3 (NCSC-NL) and Taranis-NG (SK-CERT), and represents a significant architectural evolution of that lineage.

Core Workflow

The platform organizes work into four main stages:

• Assess: Analysts review collected news items and stories, apply filters, bookmarks, and tags, and manage version history.
• Analyze: Structured report items are created, edited, and filtered from assessed stories.
• Publish: Reports are rendered into final products (HTML, JSON, PDF, plain text) and published manually or via autopublish.
• Omnisearch: A global search bar spans Stories, Reports, and Products with advanced filter syntax.

Architecture and Services

Taranis AI is deployed via Docker Compose and consists of several services:

• Ingress: Nginx reverse proxy as the entrypoint
• Frontend: Flask, HTMX, and Tailwind CSS-based web UI
• Core: REST API backend communicating with the database and exposing endpoints to workers and the frontend
• Worker: RQ workers handling collectors, bots, presenters, and publishers
• Database: PostgreSQL (primary) or SQLite
• Redis: Message broker and job queue for RQ workers
• SSE Broker: Server-Sent Events for real-time updates

An OpenAPI 3.1 spec is bundled and accessible in running installations. Health endpoints (/api/isalive and /api/health) support operational monitoring.

AI and NLP Capabilities

Taranis AI applies several NLP and AI features to collected content:

• Entity recognition and automatic summary creation
• Story clustering to reduce analyst workload
• Recognition of cybersecurity-specific terms including APTs, CVEs, and IoCs
• An asynchronous task queue (via RQ/Redis) for background news item processing
• Integration with IntelOwl for enrichment
• Experimental MISP integration for collaborative threat intelligence sharing between Taranis AI instances

Hardware Requirements and Deployment

The README specifies minimum hardware: with full NLP features, at least 16 GB RAM, 4 CPU cores, and 50 GB disk storage are required. Without NLP, 2 GB RAM, 2 CPU cores, and 20 GB disk storage suffice. Deployment is Docker Compose-based, with documentation covering TLS, monitoring, and Redis/RQ background job configuration.

Update: Version 1.4.2

The latest release is version 1.4.2, published on July 20, 2026. The repository was last pushed to on August 3, 2026, indicating active development. The project migrated from Celery/RabbitMQ to RQ/Redis as its task queue, with a migration guide provided for existing deployments. Documentation was last modified in July 2026, reflecting ongoing maintenance and community contribution activity.