A solid foundation
Run investigations on a durable graph core that stays stable while your tooling comes and goes.
Flow-native OSINT workbench
Connect the dots.See the truth.
Flowsint is an open-source graph analysis and intelligence platform. Collect entities, run enrichment flows and read every relationship your investigation depends on - all in one graph.
Google sign-in, Stripe billing, no credit card for the free credits in your account.
Python + REST enrichersn8n compatibleSTIX 2.x on the roadmapOpen core on GitHub
Entities
domainacme-shipping.com
ip12.34.56.78
domainmail.acme-shipping.com
emailops@acme-shipping.com
orgAcme Shipping LLC
wallet0x8f2c...41ab
emailj.doerr@proton.me
820 notes
enrich: ip → asndone
resolve: domain → ipdone
pivot: wallet → txrunning
820 nodes1,964 edges3 flows running
Inspector
typedomain
registrarGandi SAS
created2024-11-02
asnAS204601
riskelevated
neighbours169
Enrichers
whoisresolve
dnsresolve
wallet-clusterqueue
Investigations outlive the tools you collect them with
OSINT tools evolve, appear and disappear. What never changes is the need to see, exploit and analyse data clearly. Flowsint gives your investigations a durable base, and turns tooling into extensions you can plug in or remove at any time.
Instead of juggling fragile scripts and siloed services, centralise what you know in one graph. Add a new source, swap an API, change a schema - the case stays intact and your insight keeps compounding.
Plug-and-play tools
Connect or replace OSINT collectors in minutes through Python, REST or n8n. No lock-in.
Break data silos
Centralise, link and visualise entities and relationships instead of juggling scripts and spreadsheets.
Built for change
Add fields and entity types as the case evolves without breaking the data you already collected.
See Flowsint in action
Create a flow, run it against the entities in your case, then read the result in the graph. Nothing here needs a schema migration or a deploy.
Create a flow
Choose the entity type that should trigger work and chain the enrichers you need.
Run the flow
Executions stream their logs back to the workbench, so you watch each enrichment land.
Analyse the data
Follow the relationships in the graph, pivot on neighbours, and export the case when it closes.
Triggerentity.created == domain->dns.resolvewebhook / python->whois.lookupwebhook / python
graph.upsertentities + relations->n8n.runalerts + reports->report.rendermarkdown + email
14:02:11 flow=domain-footprint step=dns.resolve status=ok 22ms
14:02:11 flow=domain-footprint step=whois.lookup status=ok 380ms
14:02:12 graph=upsert nodes=+7 edges=+19 status=ok
14:02:12 notify=slack channel=#soc status=queued
Built for modular, extensible investigations
Flowsint is designed around a stable core and a wide edge: entity exploration, schema modelling and enrichment all stay independent of each other.
Feature
Entities and relationships exploration
An interactive graph UI to explore, edit and expand entities and their relationships. Expand neighbours by hop, filter by type and follow the path that matters.
- Expand neighbours one to three hops at a time
- Type filters, tags and saved investigation views
- Inline editing of entities and their relations
- Timeline and case export for the finished report
Relations
resolves_to34
registered_by1
shares_asn212
paid_by6
mentioned_in58
Feature
Flexible entity modeling
Define how your data is structured with dynamic schemas. Strongly typed fields, rich relations and validation keep the graph clean as the investigation grows.
- Custom entity types and field types
- Rich relation metadata and properties
- Schema evolution without breaking stored data
- Validation and type safety on every write
domain
registrartext
created_atdate
nameserverstext[]
risk_scorenumber
wallet
addresstext
chainenum
first_seendate
tagstext[]
Feature
Pluggable enrichers
Write enrichment steps as simple Python or REST webhooks, then run them by hand or chain them into flows that keep the graph current.
- Python and REST webhook contracts
- Manual, chained or scheduled execution
- n8n integration for more than 500 services
- Idempotent graph merges on every run
@enricher(name="domain.whois", inputs=["domain"])
def run(entity):
record = whois.lookup(entity.value)
return {
"registrar": record.registrar,
"created_at": record.created,
"nameservers": record.ns,
}
POST /enrich/domainruns on entity.created->graph.mergeidempotent upsert
Unlock endless possibilities with n8n
Flowsint plugs into n8n workflows (or any other webhook connector) to reach more than 500 services. Build automation that keeps the graph enriched while you work the case.
Automated OSINT collection
Collect and enrich data from public sources as soon as new entities land in the case.
Real-time threat monitoring
Trigger alerts in Slack or Teams when indicators of compromise appear in the graph.
Investigation report automation
Generate and distribute case reports to email or cloud storage at every milestone.
Cross-platform entity tracking
Search multiple platforms for one entity and merge the new connections back into the graph.
Teams that need to understand complex relationships
Flowsint is built for professionals who have to explain how people, infrastructure, money and content connect.
Cybersecurity & threat analysts
Investigate threats, analyse attack patterns and map threat actor relationships.
OSINT researchers
Gather and analyse open-source intelligence from many sources in one graph.
Investigative journalists
Uncover connections, trace relationships and build stories that hold up.
Corporate intelligence teams
Monitor the competitive landscape and map business relationships.
R&D and innovation analysts
Track emerging technologies, patents, papers and the people behind them.
Anyone mapping complex relationships
Map, enrich and navigate interconnected data without writing a platform first.
What lands next
Planned capabilities that make Flowsint more powerful for investigation work. The core stays open source.
Custom entity types
Model any domain with your own types instead of a fixed set of entities.
Built-in enrichers
Ship a maintained catalogue of enrichers next to the platform itself.
STIX 2.x support
Import and export full STIX 2.x objects for cyber threat intelligence workflows.
Plans that scale with the size of your cases
Every plan opens the same workbench. Choose monthly or yearly billing, and upgrade when your investigations grow.
Starter
300 credits a month, one investigation at a time.
$9/ month
- Cancel anytime from the billing settings
- Yearly billing saves 17%
- Invoices and payment history in your account
ProPopular
1,000 credits, saved views and scheduled flows.
$19/ month
- Cancel anytime from the billing settings
- Yearly billing saves 17%
- Invoices and payment history in your account
Premium
3,000 credits, team seats and priority support.
$49/ month
- Cancel anytime from the billing settings
- Yearly billing saves 17%
- Invoices and payment history in your account
Monthly and yearly subscriptions run through Stripe. See the full comparison on the pricing page.
Frequently asked questions
Short answers about the platform, the data it works with and how billing fits together.
What is Flowsint?
Flowsint is an open-source graph analysis and intelligence platform. It centralises entities and relationships in one graph, so enrichment tools can be plugged in, replaced or chained without losing the investigation.
Which data sources can I use?
Any source you can reach from a Python or REST webhook: DNS and WHOIS records, certificate transparency, breach datasets, public registries, social platforms or your own internal systems.
Do I need to be a developer to use it?
The workbench is point and click. Enrichers are the developer surface: they are small Python or REST handlers, and flows can also be orchestrated from n8n without touching the platform schema.
Which plans are available?
Monthly and yearly subscriptions: Starter, Pro and Premium. Every plan opens the same workbench and differs in credits, saved cases and support. Billing runs through Stripe and can be cancelled at any time.
How does sign-in work?
Accounts use Google sign-in only, so there is no extra password to manage. The header button checks your account and subscription, then takes you to the workbench or to the pricing page.
Is the data shown on this site real?
No. Every entity, relationship and graph on this site is dummy data, and no scanning or data collection has been performed on any person or organisation.
Turn scattered data into one investigation graph
Sign in with Google, pick a plan and start enriching your first entities today. The core is open source, so you can also run it yourself.
Signed-in accounts keep their cases and credits between sessions.