mirror of
https://github.com/reconurge/flowsint.git
synced 2026-07-15 21:23:01 -05:00
docs: sync with flowsint-types and flowsint-enrichers (v1.2.8)
- available-enrichers.mdx: add 17 missing enrichers, drop phantom entries - managing-enrichers.mdx: fix stale Troubleshooting referencing EnricherRegistry.register() - managing-types.mdx: note 8 registered-but-uncategorized types - bump all frontmatter to version 1.2.8 / 2026-05-15
This commit is contained in:
dextmorgn
53
docs/getting-started/enrichers.mdx
Normal file
53
docs/getting-started/enrichers.mdx
Normal file
@@ -0,0 +1,53 @@
|
||||
---
|
||||
title: "Enrichers"
|
||||
description: "Quick start guide to using Enrichers for your OSINT investigations."
|
||||
category: "Getting started"
|
||||
order: 4
|
||||
author: "Flowsint Team"
|
||||
tags: ["tutorial", "getting-started", "enrichers"]
|
||||
version: "1.2.8"
|
||||
last_updated_at: "2026-05-15"
|
||||
---
|
||||
|
||||
### What is an Enricher?
|
||||
|
||||
An enricher is an operation that, starting from an input element A (source entity), produces one or more elements B (target entities) by applying a search or correlation method called a pivot.
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
A = my.domain.com (domain name)
|
||||
↓
|
||||
p = “DNS resolution” (pivot)
|
||||
↓
|
||||
B = 12.23.34.45 (IP address)
|
||||
```
|
||||
|
||||
That said, a pivot is the method or technical process used to derive B from A. The pivot defines how the transformation obtains its result (e.g., DNS resolution, WHOIS lookup, API query, etc.).
|
||||
|
||||
Example:
|
||||
|
||||
```bash
|
||||
DNS Resolution → domain → IP
|
||||
↓
|
||||
WHOIS Lookup → IP → owner
|
||||
↓
|
||||
Reverse Image Search → image → web pages containing that image
|
||||
```
|
||||
|
||||
Flowsint comes with a bunch of prebuilt enrichers, divided into multiple categories. Those enrichers can use standard pivots that your machine can support by default (DNS resolution, WHOIS request, etc.) and some other that depend on external tools.
|
||||
|
||||
Those can be :
|
||||
|
||||
- Native : DNS resolutions, Whois, etc.
|
||||
- Docker tools: [subfinder](https://github.com/projectdiscovery/subfinder), [asnmap](https://github.com/projectdiscovery/asnmap), etc.
|
||||
- Python tools: [sherlock](https://github.com/sherlock-project/sherlock), [maigret](https://github.com/soxoj/maigret), [reconurge/recontrack](https://github.com/reconurge/recontrack), [reconurge/reconcrawl](https://github.com/reconurge/reconcrawl), [reconurge/reconspread](https://github.com/reconurge/reconspread), etc.
|
||||
- External services (paid or free): [shodan](https://www.shodan.io/), [whoxy](https://www.whoxy.com/), [whoisxmlapi](https://www.whoisxmlapi.com), etc.
|
||||
|
||||
### Making your own enrichers
|
||||
|
||||
Creating your own enrichers invloves multiple steps, but is not that trivial.
|
||||
|
||||
If you plan on writting your own enrichers and think they could help the community, please contribute by making a pull request !
|
||||
|
||||
Please refer to [this section](/docs/developers/managing-enrichers) to start building your own enrichers.
|
||||
159
docs/getting-started/flows.mdx
Normal file
159
docs/getting-started/flows.mdx
Normal file
@@ -0,0 +1,159 @@
|
||||
---
|
||||
title: "Flows"
|
||||
description: "Quick start guide to using Flows for your OSINT investigations."
|
||||
category: "Getting started"
|
||||
order: 5
|
||||
author: "Flowsint Team"
|
||||
tags: ["tutorial", "getting-started", "flows"]
|
||||
version: "1.2.8"
|
||||
last_updated_at: "2026-05-15"
|
||||
---
|
||||
|
||||
### What are Flows?
|
||||
|
||||
Flows are the chaining of multiple enrichers, where the output of one becomes the input of the next, allowing an investigation to be broadened or deepened.
|
||||
|
||||
Some enrichers can be chained together, to that they can provide a reproductible and scalable research flow that can be re-applied to other entities of the same type.
|
||||
|
||||
### Getting started with Flows
|
||||
|
||||
The best way to get started with flows is to go to [http://localhost:5173/dashboard/flows](http://localhost:5173/dashboard/flows) and create a new flow.
|
||||
|
||||
From that, you can start building your first flow; a flow consists of **one** input type, and multiple chained enrichers.
|
||||
|
||||
Start by drag & dropping your input type to the canva and start using the "**+**" button to add more enrichers to your flow.
|
||||
|
||||
Once you're satisfied with the flow, you can start viewing the execution order by pressing the "**compute**" button.
|
||||
|
||||
Make sure you give it a descriptive name and save ! (`crtl + s` or presse the save button).
|
||||
|
||||
Once it's done, go back to one of your sketches, right click on an item of the same type of the flow, and you should be able to launch it from the "flows" section.
|
||||
|
||||
### Flow schema
|
||||
|
||||
Every time a flow is launched, a log file is created at `flowsint_core/enricher_logs`.
|
||||
|
||||
```json
|
||||
{
|
||||
"sketch_id": "6aa808e4-1360-4c4a-b94f-4bed6c914836",
|
||||
"scan_id": "52ba38a2-3f2c-4c8b-a7a5-42656f8fb845",
|
||||
"created_at": "2025-10-26T15:57:52.243549",
|
||||
"updated_at": "2025-10-26T15:57:52.424052",
|
||||
"status": "completed",
|
||||
"enricher_branches": [
|
||||
{
|
||||
"id": "branch-0",
|
||||
"name": "Main Flow",
|
||||
"steps": [
|
||||
{
|
||||
"nodeId": "Domain-1761469976169",
|
||||
"params": {},
|
||||
"type": "type",
|
||||
"inputs": {},
|
||||
"outputs": {
|
||||
"domain": [
|
||||
"example.com"
|
||||
]
|
||||
},
|
||||
"status": "pending",
|
||||
"branchId": "branch-0",
|
||||
"depth": 0
|
||||
},
|
||||
{
|
||||
"nodeId": "domain_to_ip-1761469978018",
|
||||
"params": {},
|
||||
"type": "enricher",
|
||||
"inputs": {
|
||||
"Domain": null
|
||||
},
|
||||
"outputs": {
|
||||
"address": "example.com",
|
||||
"latitude": "example.com",
|
||||
"longitude": "example.com",
|
||||
"country": "example.com",
|
||||
"city": "example.com",
|
||||
"isp": "example.com"
|
||||
},
|
||||
"status": "pending",
|
||||
"branchId": "branch-0",
|
||||
"depth": 1
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"execution_log": [
|
||||
{
|
||||
"step_id": "branch-0_domain_to_ip-1761469978018",
|
||||
"branch_id": "branch-0",
|
||||
"branch_name": "Main Flow",
|
||||
"node_id": "domain_to_ip-1761469978018",
|
||||
"enricher_name": "domain_to_ip",
|
||||
"inputs": [
|
||||
"example.com"
|
||||
],
|
||||
"outputs": [
|
||||
{
|
||||
"address": "12.34.56.78",
|
||||
"latitude": null,
|
||||
"longitude": null,
|
||||
"country": null,
|
||||
"city": null,
|
||||
"isp": null
|
||||
}
|
||||
],
|
||||
"status": "completed",
|
||||
"error": null,
|
||||
"timestamp": "2025-10-26T15:57:52.274147",
|
||||
"execution_time_ms": 144,
|
||||
"cache_hit": false
|
||||
}
|
||||
],
|
||||
"summary": {
|
||||
"total_steps": 1,
|
||||
"completed_steps": 1,
|
||||
"failed_steps": 0,
|
||||
"total_execution_time_ms": 144
|
||||
},
|
||||
"final_results": {
|
||||
"initial_values": [
|
||||
"example.com"
|
||||
],
|
||||
"branches": [
|
||||
{
|
||||
"id": "branch-0",
|
||||
"name": "Main Flow",
|
||||
"steps": [
|
||||
{
|
||||
"nodeId": "domain_to_ip-1761469978018",
|
||||
"enricher": "domain_to_ip",
|
||||
"status": "completed",
|
||||
"outputs": [
|
||||
{
|
||||
"address": "12.34.56.78",
|
||||
"latitude": null,
|
||||
"longitude": null,
|
||||
"country": null,
|
||||
"city": null,
|
||||
"isp": null
|
||||
}
|
||||
]
|
||||
}
|
||||
]
|
||||
}
|
||||
],
|
||||
"results": {
|
||||
"domain_to_ip-1761469978018": [
|
||||
{
|
||||
"address": "12.34.56.78",
|
||||
"latitude": null,
|
||||
"longitude": null,
|
||||
"country": null,
|
||||
"city": null,
|
||||
"isp": null
|
||||
}
|
||||
]
|
||||
},
|
||||
"reference_mapping": {}
|
||||
}
|
||||
}
|
||||
```
|
||||
42
docs/getting-started/quickstart.mdx
Normal file
42
docs/getting-started/quickstart.mdx
Normal file
@@ -0,0 +1,42 @@
|
||||
---
|
||||
title: "Installation"
|
||||
description: "Quick start guide to using Flowsint for your OSINT investigations."
|
||||
category: "Getting started"
|
||||
order: 3
|
||||
author: "Flowsint Team"
|
||||
tags: ["tutorial", "quickstart", "installation"]
|
||||
version: "1.2.8"
|
||||
last_updated_at: "2026-05-15"
|
||||
---
|
||||
|
||||
### Prerequisites
|
||||
|
||||
Before installing Flowsint, ensure you have the following installed on your system:
|
||||
|
||||
- **Docker** and **Docker Compose**
|
||||
- **Make** (for build automation)
|
||||
- **Git**
|
||||
|
||||
### Installation
|
||||
|
||||
Clone the repo and run the start command.
|
||||
|
||||
```bash
|
||||
git clone https://github.com/reconurge/flowsint.git
|
||||
cd flowsint
|
||||
make prod
|
||||
```
|
||||
|
||||
Some enrichers require API keys. Check out [this section](/docs/getting-started/enrichers#api-keys) to learn more.
|
||||
|
||||
The application should automatically open at http://localhost:5173.
|
||||
|
||||
### Create your first investigation
|
||||
|
||||
Start by logging in or registering from the home page. From your dashboard, create a new investigation by clicking "New investigation." Add your first entity—such as a domain name—to the canvas. Right-click the entity to open the context menu and run an enricher. As results appear, explore the newly discovered entities and relationships directly in the graph.
|
||||
|
||||
### Running your first enricher
|
||||
|
||||
You could start by discovering subdomains for a domain for example.
|
||||
|
||||
Add a domain entity like `example.com` to your investigation, then right-click the domain node and select the "domain_to_subdomains" enricher. Wait for the enricher to complete; newly discovered subdomains will be added to your graph for you to review.
|
||||
58
docs/getting-started/vault.mdx
Normal file
58
docs/getting-started/vault.mdx
Normal file
@@ -0,0 +1,58 @@
|
||||
---
|
||||
title: "Vault"
|
||||
description: "Quick start guide to using the Vault to secure your services API keys and secrets."
|
||||
category: "Getting started"
|
||||
order: 6
|
||||
author: "Flowsint Team"
|
||||
tags: ["tutorial", "getting-started", "vault"]
|
||||
version: "1.2.8"
|
||||
last_updated_at: "2026-05-15"
|
||||
---
|
||||
|
||||
## What is the Vault
|
||||
|
||||
A good amount of the tools you'll be using in Flowsint require third party API keys.
|
||||
|
||||
The **Vault** (*"Coffre fort"* in french) is the place to centralize and securely store those API keys.
|
||||
Weither you have a local instance of Flowsint or one fully deployed on a distributed system, you need to have your keys securely stored.
|
||||
|
||||
## Adding a key
|
||||
|
||||
In the Flowsint enricher ecosystem, the API keys follow a specific format, being in uppercase letters, and with a declarative name that follows `<service>_API_KEY`.
|
||||
|
||||
## Current limitations
|
||||
|
||||
For now, we cannot match a particular key from the Vault to an enricher **directly from the UI**. The enricher declares the API key variable name it requires, like the following in the core of the Enricher:
|
||||
|
||||
```python
|
||||
@classmethod
|
||||
def get_params_schema(cls) -> List[Dict[str, Any]]:
|
||||
"""Declare required parameters for this enricher"""
|
||||
return [
|
||||
{
|
||||
"name": "PDCP_API_KEY",
|
||||
"type": "vaultSecret",
|
||||
"description": "The ProjectDiscovery Cloud Platform API key for asnmap.",
|
||||
"required": True,
|
||||
},
|
||||
]
|
||||
```
|
||||
|
||||
This is a known limitation and we are working on improving this.
|
||||
|
||||
In the meanwhile, here is a list of the needed keys to run Flowsint at it's full potential:
|
||||
|
||||
```bash
|
||||
# for enrichers
|
||||
WHOXY_API_KEY # Whoxy domain search engine [WHOXY]
|
||||
PDCP_API_KEY # ProjectDiscovery Cloud Platform [ASNMAP], [NAABU] etc
|
||||
HIBP_API_KEY # HaveIBeenPwned API key [HIBP]
|
||||
ETHERSCAN_API_KEY # Etherscan crypto API key [ETHERSCAN]
|
||||
# for Flo, AI assistant
|
||||
MISTRAL_API_KEY
|
||||
# but other providers will be supported soon (ChatGPT, etc.)
|
||||
```
|
||||
|
||||
There are also some other tools that could need a bunch of other API keys like [Subfinder](https://github.com/projectdiscovery/subfinder). Configuring them is not possible for now, but will be soon.
|
||||
|
||||
Stay tuned for updates as those mechanisms may vary in the future, as the goal is to keep the user experience as smooth as possible.
|
||||
Reference in New Issue
Block a user