PatrowlManager is the Django front-end of PatrOwl, a free and open-source platform for orchestrating security operations, built for security teams that need to manage assets, run scans through PatrowlEngines, aggregate the results, relay alerts to third parties, and produce reports and dashboards from one web interface and one JSON API.

What it is

PatrowlManager is the front-end application of the PatrOwl platform. It manages assets, reviews risks in real time, orchestrates operations such as scans, searches and API calls, aggregates the results, relays alerts to third parties such as TheHive or Splunk, and provides reports and dashboards. The operations themselves are performed by PatrowlEngines instances, which are separate Flask micro-applications that perform scans, analyse results and format them in a normalized way. PatrowlManager is written in Python with Django, PatrowlEngines use Flask, and asynchronous tasks and engine scalability are supported by RabbitMQ and Celery. The manager is reachable through the embedded web interface or through the JSON API, while engines are available only through generic JSON API calls.

The concrete problem it solves is coordination. A security team running several vulnerability scanners, threat-intelligence sources and search services usually ends up with one console per tool, per-tool result formats and no shared view of which asset carries which risk. PatrowlManager replaces that arrangement: it holds the asset inventory, dispatches the same operation to one or more engines, normalizes the output, tracks findings, and pushes alerts onward into incident response. It lives in the infrastructure and operations ecosystem as an orchestration and scheduling layer for security tooling, sitting between the scanners and the SIEM or case management platform.

Key capabilities

• Orchestrates operations across one or multiple PatrowlEngines instances, which perform the scans, analyse results and format them in a normalized way.
• Exposes two access paths: the embedded web interface and a JSON API, the latter being the only interface PatrowlEngines expose.
• Manages assets and supports real-time risk review alongside orchestration.
• Relays alerts to third parties, with TheHive and Splunk given as examples of incident response and downstream platforms.
• Supports asynchronous tasks and engine scalability through RabbitMQ and Celery.
• Aggregates results and provides reports and dashboards.
• Released under AGPL-3.0, with a stated commitment to remain free and open source long-term.

Who uses it and how

• Security operations and SecOps teams that need one place to define scans, searches and API calls across several tooling engines instead of one console per tool.
• Incident response and threat hunting teams that want findings relayed automatically into a case management platform such as TheHive.
• Vulnerability management programs that track findings against a maintained asset inventory over time, cycling from detection through review.
• Organizations running more than one engine, where the RabbitMQ and Celery workers let engine capacity scale independently of the front-end.
• Teams integrating PatrOwl into existing automation through the JSON API rather than the web interface.

Getting started

Install by following the Installation Guide and the User Guide in the PatrowlDocs repository, then install and deploy the PatrowlEngines instances separately, because PatrowlManager does not perform any operations on its own.

How it compares

No list of paid products that this project replaces is provided, and no directly comparable tool is named in the facts. TheHive and Splunk appear in the documentation as destinations for relayed alerts rather than as alternatives to PatrowlManager, so the project stands alone among the comparable tools in this registry, with a commercial Pro Edition and SaaS offered by the same company alongside the open-source edition.

When to use it — and when not to

A self-hoster must operate the Django front-end, the RabbitMQ and Celery workers, and at least one separately deployed PatrowlEngines instance, so the operational surface is larger than a single container. Teams that want a managed service with no local infrastructure should look at the commercial SaaS edition instead of running this themselves. The project also carries visible rough edges: 257 open issues, roadmap entries for enhanced finding state management, scan campaigns and caching still unchecked, and a README whose Pro Edition feature list stops mid-sentence, which means prospective adopters should read the documentation repository rather than rely on the front page.