DAEDALUS is a self-hosted workbench for link analysis and open-source intelligence. You start from a single clue
(an alias, an email address, a domain, an IP, a crypto wallet), expand it with transforms that query public sources,
and end up with a graph you can question: who is behind this account, which infrastructure is shared, and what is the
shortest chain of evidence between two things that should have nothing in common.
Created by Alejandro Brea · Leer en español
The idea
In the myth, Daedalus designed the labyrinth of Knossos and Ariadne's thread led Theseus back out of it. An
investigation feels the same from the inside: every pivot opens new corridors, and after an hour it is hard to say how
you got from the first clue to the last one. DAEDALUS keeps the map of the labyrinth for you (the graph) and gives you
the thread (path finding) to see exactly how any two points are connected.
It speaks the vocabulary analysts already know from Maltego, entities, transforms and machines, and adds what a
graph is good for: shortest paths, communities, centrality and choke points. Everything runs on your own machine or
server, in a single Python process with a SQLite file, and most transforms work without any API key.
A tour in five steps
The screenshots come from the demo investigation bundled in examples/operation-minotaur.json, a made-up case where
every person, .example domain and documentation-range IP is fictional. Import it to follow along offline.
1. Drop a clue. Type anything in the top bar (DAEDALUS recognises 20 entity types: aliases, emails, phones, names,
domains, IPs, netblocks, URLs, wallets, hashes, CVEs, tracking codes, coordinates…) or drag a type from the palette.
Photos dropped on the canvas are read for EXIF data and GPS.
2. Expand it. Right-click an entity to run one of its transforms, run them all, or launch a machine that walks
several steps on its own (domain, IP, identity and website footprints, or the open-ended Labyrinth). Results stream
in live and every new node keeps a labelled link explaining where it came from.
3. Follow the thread. Pick an origin and a target and Ariadne returns the k shortest paths between them, hop by
hop, with the evidence on every link. With three or more entities selected it draws the smallest subgraph that joins
them.
4. Read the structure. The analysis panel sizes nodes by betweenness, PageRank or degree, colours them by
community, marks the choke points whose removal would split the case, and suggests same-type entities that share
neighbours and may be the same identity.
5. Put it in time and space, then report. Every dated fact lands on a timeline, every coordinate on a map. Notes,
bookmarks, a sortable table and exports to JSON, GraphML (Gephi, yEd), CSV and PNG close the loop.
Run it
| Where | How |
|---|
| Your computer (Python 3.11+) | git clone https://github.com/BreaGG/DAEDALUS.git && cd DAEDALUS && ./start.sh (Windows: start.bat). Opens http://127.0.0.1:8787. |
| Docker | DAEDALUS_PASSWORD='long-random-string' docker compose up -d --build |
| Railway | Deploy the repository (it ships a railway.toml), add the DAEDALUS_PASSWORD variable, attach a volume, generate a domain. |
| Your own server | Docker Compose behind Caddy or Nginx with HTTPS. |
DAEDALUS has no user accounts: anyone who can reach it can use it. It only listens on 127.0.0.1 by default; whenever
you expose it, set DAEDALUS_PASSWORD and serve it over HTTPS (on Railway it refuses to start without a password).
Full instructions, environment variables and a reverse-proxy example are in the
deployment chapter.
The interface is in English by default and also available in Spanish (Settings → Language).
Documentation
- User guide: every panel, workflow and setting, with example investigations and
troubleshooting.
- Technical documentation: architecture, configuration, deployment, security model, the
HTTP API with live progress events, and how to write transforms, machines and plugins.
- Reference: all entity types, the 46 transforms, the machines and the API keys,
generated from the code.
Also in Spanish: guía de usuario,
documentación técnica, referencia.
Sources
46 transforms grouped in nine families; 41 of them need no key at all.
This is the beginning of the README. Read the rest at the original. Read the full README ↗
