MSSP-grade Threat Intelligence API

The Threat Intelligence brain other security tools plug into.

OmniIntel is the multi-tenant TI API. Indicators, CVEs, actors, malware, MITRE TTPs — answered with evidence chains, retrieval traces, and graph context. STIX 2.1 / TAXII 2.1 native. Region-resident. Agentic.

STIX 2.1·TAXII 2.1·MITRE ATT&CK·OpenAPI 3.1·Webhook firehose

enrich.ts · node 20200 OK · 12 ms

// Look up any indicator. Get the full evidence chain back.
import { OmniIntel } from "@omni-intel/sdk";

const ti = new OmniIntel({ apiKey: process.env.OMNI_INTEL_KEY });

const result = await ti.enrich("http://evil.example/payload.exe");

console.log(result.verdict);       // → "malicious"
console.log(result.confidence);    // → 0.92
console.log(result.evidence[0]);   // → { source: "abusech/urlhaus",
                                   //     fetched_at: "2026-05-13T08:21:11Z",
                                   //     confidence: 0.8,
                                   //     snippet: "URLhaus: malware_download …"
                                   //   }
console.log(result.trace);         // → { retrievers: [{ name: "lexical",
                                   //                    hits: 3,
                                   //                    latency_ms: 12 }] }

25+

Sources at launch

Retrieval strategies

<400 ms

p95 cache-hit latency

100%

Cited answers

Wedges

What makes OmniIntel different.

The TI space has well-funded incumbents. Generic "feeds plus an LLM" loses. We win on six specific axes.

◈

Explainable

Every answer carries an evidence chain — which source said it, when, with what confidence. The retrieval trace is exposed too. Black-box TI is not OK anymore.

◉

Graph-native

GraphRAG over a Neo4j entity graph. Multi-hop walks: actor → campaign → TTPs → IOCs → sector. Leiden communities cluster related intel automatically.

◍

Region-aware

First-class MENA / GCC coverage and KSA data residency. Tenant data never leaves its region — not in queries, not in LLM calls, not in logs. Provable at audit.

✦

Agentic, not retrieval-only

An agent plans the lookup — which feed, which retriever, which enrichment. Critiques the evidence. Escalates to live-fetch when the KB is cold. Built on LangGraph.

⌖

Developer-grade

OpenAPI 3.1 contract drives the SDKs. JS, Python, Go. Predictable typed responses. Webhook firehose. Sandbox playground. The API your engineers expected.

⊡

Bring-your-own intel

MSSPs and enterprise tenants can push private indicators that enrich their queries without ever leaking cross-tenant. Tenant isolation is a database-level invariant.

API

Predictable, typed, cited.

One Bearer key. Every response carries an evidence chain and a retriever trace. STIX 2.1 shapes on the wire.

Enrich indicator

GET /v1/enrich/{indicator}

Free-form Q&A

POST /v1/ask

CVE context

GET /v1/cve/{id}

Graph traversal

POST /v1/graph/traverse

GET /v1/enrich/{indicator}

Look up an IP, domain, URL, hash, or email. Returns canonical metadata, reputation, related actors/malware, MITRE techniques, and the full evidence chain.

shell · JSON response

curl https://api.omniintel.example/v1/enrich/http://evil.example/payload.exe \
  -H "Authorization: Bearer $OMNI_INTEL_KEY"

{
  "indicator": "http://evil.example/payload.exe",
  "type": "url",
  "verdict": "malicious",
  "confidence": 0.92,
  "first_seen": "2025-12-01T12:00:00Z",
  "last_seen":  "2026-05-13T08:21:11Z",
  "related_actors":  ["TA505"],
  "related_malware": ["Dridex"],
  "mitre_techniques": ["T1566.002", "T1059.001"],
  "evidence": [
    {
      "source": "abusech/urlhaus",
      "source_url": "https://urlhaus.abuse.ch/url/3000001/",
      "fetched_at": "2026-05-13T08:21:11Z",
      "confidence": 0.8,
      "tlp": "TLP:CLEAR",
      "snippet": "URLhaus: malware_download (status=online) — added 2025-12-01."
    },
    { "source": "virustotal", "confidence": 0.95, "...": "..." }
  ],
  "trace": {
    "retrievers": [
      { "name": "lexical", "hits": 2, "latency_ms":  8 },
      { "name": "semantic","hits": 1, "latency_ms": 14 }
    ]
  }
}

POST /v1/ask

Ask in natural language. The agent classifies the query, plans the retriever mix, critiques the evidence, and returns a cited answer.

shell · JSON response

curl -X POST https://api.omniintel.example/v1/ask \
  -H "Authorization: Bearer $OMNI_INTEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "Which actors targeted GCC oil & gas in 2026 using ransomware?",
    "max_evidence": 8,
    "time_window_days": 365
  }'

{
  "answer": "Three intrusion-sets stood out: OilRig (APT34), MuddyWater (Mango Sandstorm),
  and a newly-tracked cluster TA505-ME using LockBit 4.0 affiliates. Healthcare and refining
  were dual-targeted [1][2]. KSA Aramco subsidiaries received the heaviest pressure in Q1 [3].",
  "confidence": 0.74,
  "evidence": [
    { "source": "mitre/attack", "snippet": "G0049 OilRig — refining sector pivots …",
      "confidence": 0.85, "tlp": "TLP:CLEAR", "fetched_at": "2026-05-09T…" },
    { "source": "saudiCERT",    "snippet": "Q1 advisory — credential harvesting …",
      "confidence": 0.78, "tlp": "TLP:GREEN", "fetched_at": "2026-04-22T…" }
  ],
  "trace": {
    "retrievers": [
      { "name": "graph",   "hits": 11, "latency_ms": 142 },
      { "name": "hybrid",  "hits":  6, "latency_ms":  88 },
      { "name": "semantic","hits":  4, "latency_ms":  46 }
    ],
    "agent_steps": [
      { "step": "classify",  "decision": "graph_walk + free_form" },
      { "step": "plan",      "decision": "graph -> hybrid -> semantic" },
      { "step": "critique",  "decision": "evidence sufficient (4 indep. sources)" }
    ]
  }
}

GET /v1/cve/{id}

KEV status, EPSS, public PoCs, actors known to exploit, affected products, fix availability.

shell · JSON response

curl https://api.omniintel.example/v1/cve/CVE-2025-12345 \
  -H "Authorization: Bearer $OMNI_INTEL_KEY"

{
  "id": "CVE-2025-12345",
  "published_at": "2025-11-04T00:00:00Z",
  "cvss_v3": 9.8,
  "epss": 0.94,
  "kev": true,
  "kev_added_at": "2025-11-12T00:00:00Z",
  "actors_exploiting": ["APT34", "TA505"],
  "public_pocs": ["https://github.com/example/cve-2025-12345-poc"],
  "affected_products": ["Fortinet FortiOS 7.0.0 - 7.2.3"],
  "fix_available": true,
  "evidence": [
    { "source": "cisa/kev", "fetched_at": "2025-11-12T13:00:00Z", "confidence": 1.0 },
    { "source": "nvd/cve",  "fetched_at": "2025-11-04T18:00:00Z", "confidence": 1.0 }
  ]
}

POST /v1/graph/traverse

Multi-hop entity walks. Start at an actor; walk to campaigns, TTPs, indicators, sectors. Bring back nodes + edges.

shell · JSON response

curl -X POST https://api.omniintel.example/v1/graph/traverse \
  -H "Authorization: Bearer $OMNI_INTEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "start": { "type": "threat-actor", "id": "APT34" },
    "hops": 3,
    "edge_types": ["uses", "targets", "indicates"]
  }'

{
  "nodes": [
    { "id": "APT34", "type": "threat-actor", "attrs": { "name": "OilRig", "country": "IR" } },
    { "id": "T1566.002", "type": "attack-pattern", "attrs": { "name": "Spearphishing Link" } },
    { "id": "indicator-89a…", "type": "indicator", "attrs": { "value": "phish.example" } },
    { "id": "GCC-OilGas", "type": "sector", "attrs": { "region": "ksa,uae,kw" } }
  ],
  "edges": [
    { "from": "APT34", "to": "T1566.002", "type": "uses" },
    { "from": "T1566.002", "to": "indicator-89a…", "type": "indicates" },
    { "from": "APT34", "to": "GCC-OilGas", "type": "targets" }
  ]
}

12 endpoints

Everything other security tools need.

Twelve canonical operations cover IOC enrichment, vulnerability context, actor and malware profiles, MITRE TTPs, free-form questions, graph walks, TAXII bulk pulls, webhook subscriptions, and BYOI ingestion.

◇

GET/v1/enrich/{indicator}

IP / domain / URL / hash / email enrichment

⌘

GET/v1/cve/{id}

KEV · EPSS · PoC · actor use · fixes

✦

GET/v1/actor/{name}

Threat actor and campaign profile

◉

GET/v1/malware/{name}

Family — capabilities · lineage · hashes · c2

⌖

GET/v1/ttp/{id}

MITRE ATT&CK technique context

◈

POST/v1/ask

Free-form Q&A — agentic RAG with citations

◍

POST/v1/graph/traverse

Multi-hop entity walks

≣

GET/v1/feeds/* (TAXII 2.1)

Bulk pull of STIX 2.1 bundles

↗

POST/v1/webhooks

Subscribe to live updates

⊡

POST/v1/private/submit

BYOI — tenant-scoped private intel

⊕

POST/v1/attribute

Artifact bundle → likely actor + confidence

⌬

POST/v1/rules/{stix,sigma,yara,kql}

Detection-content generation

Under the hood

Architecture you can audit.

A canonical entity model under five stores. Five retrievers above. One agent that orchestrates. Every step is observable, every answer cites its source.

Stage 101

Ingestion

25+ source workers feed STIX 2.1 into the canonical store.

›abuse.ch ×3
›NVD · CISA KEV
›MITRE ATT&CK
›OTX · VT · Shodan
›saudiCERT · UAE CERT

Stage 202

Knowledge Base

Postgres truth · pgvector · Neo4j graph · OpenSearch · S3 artifacts.

›Postgres (RLS-isolated)
›pgvector embeddings
›Neo4j graph projection
›OpenSearch FTS
›S3 raw artifacts

Stage 303

Retrieval

Five strategies. Lexical, semantic, graph, hybrid-RRF, live-fetch.

›BM25 lexical
›pgvector semantic
›GraphRAG + Leiden
›RRF hybrid
›Live-fetch upstream

Stage 404

Agentic orchestrator

Classify → plan → retrieve → critique → synthesise → cache.

›LangGraph FSM
›Confidence rubric
›Semantic cache
›Trace every step
›Region-pinned LLM

◇

Tenant isolation is a database-level invariant.

Three layers — gateway, service, and Postgres RLS. Every row carriestenant_idand connections setSET LOCAL omni.tenant_idper checkout. A logic bug in any single layer can't leak data.

MENA / GCC wedge

First-class for Saudi Arabia and the GCC.

Western TI feeds under-cover the region. OmniIntel is built the other way round: KSA data residency from day 0, regional sources upgraded to Tier 0, Arabic-aware retrieval, and MSSP-grade multi-tenancy for the region's service providers.

✓

Stays in region

KSA tenants never touch a non-KSA store, LLM endpoint, or log sink. The gateway returns 409 + a Location hint on wrong-region requests — never silent routing.

✓

Regional sources elevated

saudiCERT, UAE CERT, GCC-CERT, Arabic-language forums, MENA-targeted Telegram. A dedicated sub-team owns regional coverage as a moat.

✓

Arabic-aware retrieval

BGE-M3 multilingual embeddings, Arabic OCR for PDF reports, English translations surfaced in the canonical model.

✓

MSSP nesting from day 1

MSSP is a tenant; their customers are sub-tenants. Cross-customer data never crosses, billing-grade metering tags every call.

Pricing

Free to start. Predictable to scale.

Every call is metered and tagged by tenant + sub-tenant + endpoint. MSSPs get billable transparency built in.

Developer

For prototypes, side projects, and SDK exploration.

$0free forever

✓1,000 requests / day
✓T0 OSINT sources only
✓Lexical + semantic retrieval
✓Single API key
✓Community Discord

Get a free key →

Team

For startups and small SOCs that need real coverage.

$1,490per month

✓100k requests / day
✓All T0 + T1 sources (VT, OTX, Shodan, GreyNoise)
✓Full agentic + GraphRAG
✓Webhook firehose
✓10 sub-tenants, e-mail support

Start trial →

MSSP / Enterprise

For MSSPs, MENA / GCC service providers, and large enterprises.

Customannual, regional pricing

✓Unlimited requests
✓T0 → T3 sources incl. dark/grey
✓KSA-resident stack option
✓Unlimited nested tenants
✓BYOI lane · mTLS · 24×7 + SLA

Talk to us →

Give your tools a real brain.

One Bearer key. Twelve endpoints. Evidence chains under every answer. Get building in under five minutes.

# install
$ npm i @omni-intel/sdk

# or
$ pip install omni-intel

# first call
$ export OMNI_INTEL_KEY=oint_live_xxxx
$ curl https://api.omniintel.example/v1/enrich/1.2.3.4 \
-H "Authorization: Bearer $OMNI_INTEL_KEY"