DAEDALUS

DAEDALUS is a self-hosted workbench for link analysis and open-source intelligence. You start from a single clue (an alias, an email address, a domain, an IP, a crypto wallet), expand it with transforms that query public sources, and end up with a graph you can question: who is behind this account, which infrastructure is shared, and what is the shortest chain of evidence between two things that should have nothing in common.

Created by Alejandro Brea · Leer en español

---

• The idea
• A tour in five steps
• Run it
• Documentation
• Sources
• Extending
• Under the hood
• Ethics
• Disclaimer
• Contributing
• License

The idea

In the myth, Daedalus designed the labyrinth of Knossos and Ariadne's thread led Theseus back out of it. An investigation feels the same from the inside: every pivot opens new corridors, and after an hour it is hard to say how you got from the first clue to the last one. DAEDALUS keeps the map of the labyrinth for you (the graph) and gives you the thread (path finding) to see exactly how any two points are connected.

It speaks the vocabulary analysts already know from Maltego, entities, transforms and machines, and adds what a graph is good for: shortest paths, communities, centrality and choke points. Everything runs on your own machine or server, in a single Python process with a SQLite file, and most transforms work without any API key.

A tour in five steps

The screenshots come from the demo investigation bundled in examples/operation-minotaur.json, a made-up case where every person, .example domain and documentation-range IP is fictional. Import it to follow along offline.

1. Drop a clue. Type anything in the top bar (DAEDALUS recognises 20 entity types: aliases, emails, phones, names, domains, IPs, netblocks, URLs, wallets, hashes, CVEs, tracking codes, coordinates…) or drag a type from the palette. Photos dropped on the canvas are read for EXIF data and GPS.

2. Expand it. Right-click an entity to run one of its transforms, run them all, or launch a machine that walks several steps on its own (domain, IP, identity and website footprints, or the open-ended Labyrinth). Results stream in live and every new node keeps a labelled link explaining where it came from.

3. Follow the thread. Pick an origin and a target and Ariadne returns the k shortest paths between them, hop by hop, with the evidence on every link. With three or more entities selected it draws the smallest subgraph that joins them.

4. Read the structure. The analysis panel sizes nodes by betweenness, PageRank or degree, colours them by community, marks the choke points whose removal would split the case, and suggests same-type entities that share neighbours and may be the same identity.

5. Put it in time and space, then report. Every dated fact lands on a timeline, every coordinate on a map. Notes, bookmarks, a sortable table and exports to JSON, GraphML (Gephi, yEd), CSV and PNG close the loop.

Run it

Where	How
Your computer (Python 3.11+)	git clone https://github.com/BreaGG/DAEDALUS.git && cd DAEDALUS && ./start.sh (Windows: start.bat). Opens http://127.0.0.1:8787.
Docker	DAEDALUS_PASSWORD='long-random-string' docker compose up -d --build
Railway	Deploy the repository (it ships a railway.toml), add the DAEDALUS_PASSWORD variable, attach a volume, generate a domain.
Your own server	Docker Compose behind Caddy or Nginx with HTTPS.

DAEDALUS has no user accounts: anyone who can reach it can use it. It only listens on 127.0.0.1 by default; whenever you expose it, set DAEDALUS_PASSWORD and serve it over HTTPS (on Railway it refuses to start without a password). Full instructions, environment variables and a reverse-proxy example are in the deployment chapter.

The interface is in English by default and also available in Spanish (Settings → Language).

Documentation

• User guide: every panel, workflow and setting, with example investigations and troubleshooting.
• Technical documentation: architecture, configuration, deployment, security model, the HTTP API with live progress events, and how to write transforms, machines and plugins.
• Reference: all entity types, the 46 transforms, the machines and the API keys, generated from the code.

Also in Spanish: guía de usuario, documentación técnica, referencia.

Sources

46 transforms grouped in nine families; 41 of them need no key at all.

• DNS and infrastructure: A/AAAA, MX, NS, TXT with SPF and DMARC parsing, reverse DNS, subdomains from certificate transparency, co-hosted names, RDAP and WHOIS, IP ownership and routing (RIPEstat), geolocation, open ports and known CVEs (Shodan InternetDB).
• Web: website discovery, page scraping for emails, phones, social profiles, analytics IDs and outbound domains, Wayback Machine history and archived files, security.txt.
• Identity and social: email and phone analysis, an alias sweep over 75+ sites (400+ with the optional Sherlock list) that double-checks every hit, detailed profiles on ten platforms, GitHub with commit emails, Gravatar, name permutations.
• Search, location and blockchain: web mentions (DuckDuckGo, Google via Serper or Brave), Wikidata, ready-made dorks, OpenStreetMap geocoding, Bitcoin and Ethereum balances, activity and counterparties.
• Threat intelligence: breaches (XposedOrNot, Have I Been Pwned), CIRCL hashlookup, NVD, and with a key VirusTotal, Shodan, AbuseIPDB and urlscan.io.

Extending

A transform is a small async Python class. Save it in the plugins/ folder of your data directory, restart, and it appears in the right-click menu of the entity types it accepts:

from daedalus.transforms import L, Transform, register


@register
class EmailHashes(Transform):
    name = "plugin_email_hashes"
    title = L("To MD5 / SHA-256 hashes", "A hashes MD5 / SHA-256")
    description = L("Hashes of the address, as used by Gravatar and leak dumps.", "Hashes de la dirección.")
    inputs = ("email",)

    async def run(self, ctx):
        import hashlib
        email = ctx.value.lower().encode()
        ctx.add("hash", hashlib.md5(email).hexdigest(), {"algorithm": "MD5"}, label="MD5")
        ctx.add("hash", hashlib.sha256(email).hexdigest(), {"algorithm": "SHA-256"}, label="SHA-256")

The technical documentation describes the full Context API, machines, plugins and how to test transforms against mocked HTTP. Everything the interface does is also available through a JSON API, so DAEDALUS can be scripted.

Under the hood

• Backend: Python, FastAPI and httpx; an asyncio job engine that streams progress over Server-Sent Events; SQLite storage; graph algorithms (Yen, Brandes, PageRank, Louvain, Tarjan) written without external dependencies.
• Frontend: plain ES modules with Cytoscape.js and Leaflet bundled in the repository. No build step, works offline except for map tiles.
• Quality: a pytest suite where every HTTP call is mocked, ruff, and CI on Python 3.11 to 3.13.

pip install -e ".[dev]" && pytest -q && ruff check daedalus tests
python scripts/gen_docs.py   # regenerate the reference after changing transforms

Ethics

DAEDALUS only collects what public sources and the services you configure return, but the techniques it automates can hurt people when misused. Use it for security research, threat intelligence, journalism, due diligence or to audit your own exposure. Do not use it to stalk, harass or profile individuals without a lawful basis, and respect data-protection law and the terms of every source you query.

Disclaimer

DAEDALUS is provided for lawful research, educational and defensive purposes only. You are solely responsible for how you use it and for making sure that every investigation complies with the laws of your jurisdiction (including data-protection rules such as the GDPR), the terms of service of each source and API you query, and any authorization your work requires. The author and contributors accept no liability for misuse of the software or for any damage, legal claim or loss arising from its use.

Results come from third-party sources and automated heuristics: they can be incomplete, outdated or simply wrong. Verify findings independently before acting on them, and never treat a link in the graph as proof on its own. DAEDALUS is an independent project and is not affiliated with, endorsed by or sponsored by Maltego or any of the services it queries; all trademarks belong to their respective owners.

Contributing

Bug reports, new transforms, translations and fixes are welcome. Read CONTRIBUTING.md before opening a pull request.

License

Copyright © 2026 Alejandro Brea. DAEDALUS is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version (GPL-3.0-or-later). It is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; see the licence for details.

Bundled third-party libraries keep their own licences, listed in THIRD_PARTY_NOTICES.md.