Free tier, no card. 10k indicator lookups a month.Start free
OMNI
INTEL
Sign up — it's free
Threat intelligence platform

Imagine, a threat-intelligence brain.

OmniIntel collects, correlates and enriches threat data from nine upstream feeds plus your own — then answers questions about it with citations you can audit. STIX 2.1 and TAXII 2.1 native, multi-tenant to the row.

Start freeSee pricing

KSA data residency available · SDAIA-aligned

25+
Sources at launch
5
Retrieval strategies
<400 ms
p95 cache-hit latency
100%
Cited answers
STIX 2.1
TAXII 2.1 native
The platform

Intelligence you can interrogate.

Most feeds hand you a list and leave the judgement to you. OmniIntel keeps the provenance attached all the way to the answer.

Every answer carries its receipts

The Co-Analyst doesn't summarise the internet. It answers from your retained corpus and cites the exact document behind each claim, so an analyst can check the work before acting on it.

Is CVE-2026-31337 being exploited?

Yes — it's on CISA KEV as of 28 Jul, with a public PoC. Three of your assets still report the vulnerable build.

CISA KEVNVDTenant assets

One indicator, every connection

Indicators, CVEs, actors, malware and MITRE techniques are stitched into one graph. Pivot from a single IP to the campaigns and assets it touches without leaving the page.

192.168.0.123APT-GCC-04CVE-2026-31337LockBit affiliate11 sightings

Verdicts with provenance, not vibes

Nine upstream feeds are reconciled into one verdict per indicator, and every contributing source stays visible with an Admiralty code. You can always see why something is flagged.

ip192.168.0.123Malicious
ip46.8.235.187Suspicious
ip203.0.113.42Clean

Ships into the stack you already run

STIX 2.1 objects over TAXII 2.1 collections, plus a typed REST API and SDKs. No bespoke shim between OmniIntel and your SOAR, SIEM or case management.

GET /v1/taxii2/collections/indicators/objects
Authorization: Bearer <REDACTED>

{ "type": "bundle", "objects": [
  { "type": "indicator",
    "pattern": "[ipv4-addr:value = '192.168.0.123']",
    "confidence": 87,
    "labels": ["malicious-activity"] } ] }
Wedges

What makes OmniIntel different.

The TI space has well-funded incumbents. Generic "feeds plus an LLM" loses. We win on six specific axes.

◈

Explainable

Every answer carries an evidence chain — which source said it, when, with what confidence. The retrieval trace is exposed too. Black-box TI is not OK anymore.

◉

Graph-native

GraphRAG over a Neo4j entity graph. Multi-hop walks: actor → campaign → TTPs → IOCs → sector. Leiden communities cluster related intel automatically.

◍

Region-aware

First-class MENA / GCC coverage and KSA data residency. Tenant data never leaves its region — not in queries, not in LLM calls, not in logs. Provable at audit.

✦

Agentic, not retrieval-only

An agent plans the lookup — which feed, which retriever, which enrichment. Critiques the evidence. Escalates to live-fetch when the KB is cold. Built on LangGraph.

⌖

Developer-grade

OpenAPI 3.1 contract drives the SDKs. JS, Python, Go. Predictable typed responses. Webhook firehose. Sandbox playground. The API your engineers expected.

⊡

Bring-your-own intel

MSSPs and enterprise tenants can push private indicators that enrich their queries without ever leaking cross-tenant. Tenant isolation is a database-level invariant.

API

Predictable, typed, cited.

One Bearer key. Every response carries an evidence chain and a retriever trace. STIX 2.1 shapes on the wire.

API example
GET /v1/enrich/{indicator}200 ok
Look up an IP, domain, URL, hash, or email. Returns canonical metadata, reputation, related actors/malware, MITRE techniques, and the full evidence chain.
curl https://api.omniintel.example/v1/enrich/http://evil.example/payload.exe \
  -H "Authorization: Bearer $OMNI_INTEL_KEY"

{
  "indicator": "http://evil.example/payload.exe",
  "type": "url",
  "verdict": "malicious",
  "confidence": 0.92,
  "first_seen": "2025-12-01T12:00:00Z",
  "last_seen":  "2026-05-13T08:21:11Z",
  "related_actors":  ["TA505"],
  "related_malware": ["Dridex"],
  "mitre_techniques": ["T1566.002", "T1059.001"],
  "evidence": [
    {
      "source": "abusech/urlhaus",
      "source_url": "https://urlhaus.abuse.ch/url/3000001/",
      "fetched_at": "2026-05-13T08:21:11Z",
      "confidence": 0.8,
      "tlp": "TLP:CLEAR",
      "snippet": "URLhaus: malware_download (status=online) — added 2025-12-01."
    },
    { "source": "virustotal", "confidence": 0.95, "...": "..." }
  ],
  "trace": {
    "retrievers": [
      { "name": "lexical", "hits": 2, "latency_ms":  8 },
      { "name": "semantic","hits": 1, "latency_ms": 14 }
    ]
  }
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
POST /v1/ask200 ok
Ask in natural language. The agent classifies the query, plans the retriever mix, critiques the evidence, and returns a cited answer.
curl -X POST https://api.omniintel.example/v1/ask \
  -H "Authorization: Bearer $OMNI_INTEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "query": "Which actors targeted GCC oil & gas in 2026 using ransomware?",
    "max_evidence": 8,
    "time_window_days": 365
  }'

{
  "answer": "Three intrusion-sets stood out: OilRig (APT34), MuddyWater (Mango Sandstorm),
  and a newly-tracked cluster TA505-ME using LockBit 4.0 affiliates. Healthcare and refining
  were dual-targeted [1][2]. KSA Aramco subsidiaries received the heaviest pressure in Q1 [3].",
  "confidence": 0.74,
  "evidence": [
    { "source": "mitre/attack", "snippet": "G0049 OilRig — refining sector pivots …",
      "confidence": 0.85, "tlp": "TLP:CLEAR", "fetched_at": "2026-05-09T…" },
    { "source": "saudiCERT",    "snippet": "Q1 advisory — credential harvesting …",
      "confidence": 0.78, "tlp": "TLP:GREEN", "fetched_at": "2026-04-22T…" }
  ],
  "trace": {
    "retrievers": [
      { "name": "graph",   "hits": 11, "latency_ms": 142 },
      { "name": "hybrid",  "hits":  6, "latency_ms":  88 },
      { "name": "semantic","hits":  4, "latency_ms":  46 }
    ],
    "agent_steps": [
      { "step": "classify",  "decision": "graph_walk + free_form" },
      { "step": "plan",      "decision": "graph -> hybrid -> semantic" },
      { "step": "critique",  "decision": "evidence sufficient (4 indep. sources)" }
    ]
  }
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
GET /v1/cve/{id}200 ok
KEV status, EPSS, public PoCs, actors known to exploit, affected products, fix availability.
curl https://api.omniintel.example/v1/cve/CVE-2025-12345 \
  -H "Authorization: Bearer $OMNI_INTEL_KEY"

{
  "id": "CVE-2025-12345",
  "published_at": "2025-11-04T00:00:00Z",
  "cvss_v3": 9.8,
  "epss": 0.94,
  "kev": true,
  "kev_added_at": "2025-11-12T00:00:00Z",
  "actors_exploiting": ["APT34", "TA505"],
  "public_pocs": ["https://github.com/example/cve-2025-12345-poc"],
  "affected_products": ["Fortinet FortiOS 7.0.0 - 7.2.3"],
  "fix_available": true,
  "evidence": [
    { "source": "cisa/kev", "fetched_at": "2025-11-12T13:00:00Z", "confidence": 1.0 },
    { "source": "nvd/cve",  "fetched_at": "2025-11-04T18:00:00Z", "confidence": 1.0 }
  ]
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
POST /v1/graph/traverse200 ok
Multi-hop entity walks. Start at an actor; walk to campaigns, TTPs, indicators, sectors. Bring back nodes + edges.
curl -X POST https://api.omniintel.example/v1/graph/traverse \
  -H "Authorization: Bearer $OMNI_INTEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "start": { "type": "threat-actor", "id": "APT34" },
    "hops": 3,
    "edge_types": ["uses", "targets", "indicates"]
  }'

{
  "nodes": [
    { "id": "APT34", "type": "threat-actor", "attrs": { "name": "OilRig", "country": "IR" } },
    { "id": "T1566.002", "type": "attack-pattern", "attrs": { "name": "Spearphishing Link" } },
    { "id": "indicator-89a…", "type": "indicator", "attrs": { "value": "phish.example" } },
    { "id": "GCC-OilGas", "type": "sector", "attrs": { "region": "ksa,uae,kw" } }
  ],
  "edges": [
    { "from": "APT34", "to": "T1566.002", "type": "uses" },
    { "from": "T1566.002", "to": "indicator-89a…", "type": "indicates" },
    { "from": "APT34", "to": "GCC-OilGas", "type": "targets" }
  ]
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
GET /v1/stix/bundle200 ok
Pull a STIX 2.1 bundle for a TAXII consumer or SOAR. Filter by object type, cap the size, and pass ?since= for an incremental pull.
curl "https://api.omniintel.example/v1/stix/bundle?types=indicator,cve&limit=500&since=2026-07-01T00:00:00Z" \
  -H "Authorization: Bearer $OMNI_INTEL_KEY"

< HTTP/1.1 200 OK
< content-type: application/stix+json; charset=utf-8
< x-omni-stix-counts: {"indicator":412,"cve":88}
< x-omni-stix-generated-at: 2026-07-30T04:12:08.114Z

{
  "type": "bundle",
  "id": "bundle--7f1c9b02-4d3a-4f81-9c2e-0b6a51d7e8aa",
  "objects": [
    {
      "type": "indicator",
      "spec_version": "2.1",
      "id": "indicator--b2c4...",
      "pattern": "[url:value = 'http://evil.example/payload.exe']",
      "pattern_type": "stix",
      "valid_from": "2025-12-01T12:00:00Z",
      "confidence": 92,
      "labels": ["malicious-activity"]
    },
    { "type": "vulnerability", "name": "CVE-2026-31337", "...": "..." }
  ]
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
POST /v1/private/submit200 ok
Push your own indicators (BYOI). Written tenant-scoped under row-level security — visible to your org only, never to the global corpus.
curl -X POST https://api.omniintel.example/v1/private/submit \
  -H "Authorization: Bearer $OMNI_INTEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "indicators": [
      {
        "value": "185.220.101.42",
        "type": "ipv4",
        "verdict": "malicious",
        "confidence": 0.85,
        "note": "C2 beacon seen in incident INC-4417",
        "tlp": "TLP:AMBER",
        "tags": ["c2", "incident:INC-4417"]
      }
    ],
    "default_tlp": "TLP:AMBER",
    "tags": ["byoi"]
  }'

{
  "accepted": 1,
  "rejected": 0,
  "tenant_scoped": true,
  "indicators": [
    { "value": "185.220.101.42", "type": "ipv4", "id": "ind_01JQ...", "status": "stored" }
  ]
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
POST /v1/rules/generate200 ok
Turn an indicator, malware family or MITRE technique into detection content. Ask for YARA, Sigma, KQL or SPL — up to four formats per call.
curl -X POST https://api.omniintel.example/v1/rules/generate \
  -H "Authorization: Bearer $OMNI_INTEL_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "seed": { "kind": "malware", "value": "Dridex" },
    "formats": ["sigma", "kql"],
    "max_rules": 4
  }'

{
  "seed": { "kind": "malware", "value": "Dridex" },
  "rules": [
    {
      "format": "sigma",
      "title": "Dridex loader — suspicious rundll32 child process",
      "confidence": 0.81,
      "mitre_techniques": ["T1218.011"],
      "content": "title: Dridex loader\ndetection:\n  selection:\n    Image|endswith: '\\rundll32.exe'\n  condition: selection"
    },
    { "format": "kql", "title": "Dridex C2 beacon", "...": "..." }
  ],
  "citations": [
    { "source": "kb", "doc_id": "doc_01JQ...", "snippet": "Dridex loaders commonly abuse rundll32..." }
  ]
}
Auth · Bearer key|Evidence chain on every response|Retriever trace includedSDKs · TypeScript · Python
12 endpoints

Everything other security tools need.

Twelve canonical operations cover IOC enrichment, vulnerability context, actor and malware profiles, MITRE TTPs, free-form questions, graph walks, TAXII bulk pulls, webhook subscriptions, and BYOI ingestion.

◇
GET/v1/enrich/{indicator}
IP / domain / URL / hash / email enrichment
⌘
GET/v1/cve/{id}
KEV · EPSS · PoC · actor use · fixes
✦
GET/v1/actor/{name}
Threat actor and campaign profile
◉
GET/v1/malware/{name}
Family — capabilities · lineage · hashes · c2
⌖
GET/v1/ttp/{id}
MITRE ATT&CK technique context
◈
POST/v1/ask
Free-form Q&A — agentic RAG with citations
◍
POST/v1/graph/traverse
Multi-hop entity walks
≣
GET/v1/feeds/* (TAXII 2.1)
Bulk pull of STIX 2.1 bundles
↗
POST/v1/webhooks
Subscribe to live updates
⊡
POST/v1/private/submit
BYOI — tenant-scoped private intel
⊕
POST/v1/attribute
Artifact bundle → likely actor + confidence
⌬
POST/v1/rules/{stix,sigma,yara,kql}
Detection-content generation
Under the hood

Architecture you can audit.

A canonical entity model under five stores. Five retrievers above. One agent that orchestrates. Every step is observable, every answer cites its source.

Stage 101

Ingestion

25+ source workers feed STIX 2.1 into the canonical store.

  • ›abuse.ch ×3
  • ›NVD · CISA KEV
  • ›MITRE ATT&CK
  • ›OTX · VT · Shodan
  • ›saudiCERT · UAE CERT
Stage 202

Knowledge Base

Postgres truth · pgvector · Neo4j graph · OpenSearch · S3 artifacts.

  • ›Postgres (RLS-isolated)
  • ›pgvector embeddings
  • ›Neo4j graph projection
  • ›OpenSearch FTS
  • ›S3 raw artifacts
Stage 303

Retrieval

Five strategies. Lexical, semantic, graph, hybrid-RRF, live-fetch.

  • ›BM25 lexical
  • ›pgvector semantic
  • ›GraphRAG + Leiden
  • ›RRF hybrid
  • ›Live-fetch upstream
Stage 404

Agentic orchestrator

Classify → plan → retrieve → critique → synthesise → cache.

  • ›LangGraph FSM
  • ›Confidence rubric
  • ›Semantic cache
  • ›Trace every step
  • ›Region-pinned LLM
◇

Tenant isolation is a database-level invariant.

Three layers — gateway, service, and Postgres RLS. Every row carriestenant_idand connections setSET LOCAL omni.tenant_idper checkout. A logic bug in any single layer can't leak data.

MENA / GCC wedge

First-class for Saudi Arabia and the GCC.

Western TI feeds under-cover the region. OmniIntel is built the other way round: KSA data residency from day 0, regional sources upgraded to Tier 0, Arabic-aware retrieval, and MSSP-grade multi-tenancy for the region's service providers.

✓

Stays in region

KSA tenants never touch a non-KSA store, LLM endpoint, or log sink. The gateway returns 409 + a Location hint on wrong-region requests — never silent routing.

✓

Regional sources elevated

saudiCERT, UAE CERT, GCC-CERT, Arabic-language forums, MENA-targeted Telegram. A dedicated sub-team owns regional coverage as a moat.

✓

Arabic-aware retrieval

BGE-M3 multilingual embeddings, Arabic OCR for PDF reports, English translations surfaced in the canonical model.

✓

MSSP nesting from day 1

MSSP is a tenant; their customers are sub-tenants. Cross-customer data never crosses, billing-grade metering tags every call.

Pricing

Free to start. Predictable to scale.

Every call is metered and tagged by tenant + sub-tenant + endpoint. MSSPs get billable transparency built in.

Developer

For prototypes, side projects, and SDK exploration.

$0free forever
  • ✓1,000 requests / day
  • ✓T0 OSINT sources only
  • ✓Lexical + semantic retrieval
  • ✓Single API key
  • ✓Community Discord
Get a free key →
Most popular

Team

For startups and small SOCs that need real coverage.

$1,490per month
  • ✓100k requests / day
  • ✓All T0 + T1 sources (VT, OTX, Shodan, GreyNoise)
  • ✓Full agentic + GraphRAG
  • ✓Webhook firehose
  • ✓10 sub-tenants, e-mail support
Start trial →

MSSP / Enterprise

For MSSPs, MENA / GCC service providers, and large enterprises.

Customannual, regional pricing
  • ✓Unlimited requests
  • ✓T0 → T3 sources incl. dark/grey
  • ✓KSA-resident stack option
  • ✓Unlimited nested tenants
  • ✓BYOI lane · mTLS · 24×7 + SLA
Talk to us →
FAQ

The questions we actually get asked.

Including the awkward ones. If something isn't answered here, email [email protected] and a human will reply.

What do I get on the free tier, and do I need a card?
No card. A new account starts on the free tier: 10,000 requests a month with a 20/second burst, across 25+ OSINT sources. Bring-your-own-indicator submission and TAXII subscription are paid-tier features — see pricing for the full matrix.
How is this different from a threat feed?
A feed hands you a list and leaves the judgement to you. OmniIntel keeps provenance attached through to the answer: every verdict shows which of the contributing sources said what, when it was fetched, and with what confidence — and the Co-Analyst cites the specific document behind each claim rather than summarising in the abstract.
Can I submit my own indicators without them leaking to other tenants?
Yes. Private intel is written tenant-scoped and enforced by row-level security in Postgres rather than by application filtering, so it is never merged into the global corpus and is not visible to any other tenant — including a parent MSSP. Details on the security page.
Where is my data stored? Can you guarantee KSA residency?
A tenant is pinned to a region, and the pin is locked once data has been ingested. For KSA-region tenants the data is stored and processed on KSA infrastructure and is not routed elsewhere — that's a hard constraint in how requests are routed, not a configuration default you have to remember to set.
Do you have SOC 2 or ISO 27001?
Not yet — neither is certified, and we'd rather say so here than let the omission imply otherwise. A third-party penetration test is in progress. We're happy to walk through our control descriptions and complete a security questionnaire in the meantime; the security page lists what is and isn't in place.
How does it fit the tooling I already run?
STIX 2.1 objects over TAXII 2.1 collections, so a SOAR or SIEM can poll without a translation layer, plus a typed REST API and official TypeScript and Python SDKs. One Bearer key, scoped per tenant and revocable individually.
What happens if I exceed my quota?
Requests over the burst ceiling are rate-limited rather than silently dropped, and you get a clear error with the limit that was hit. Monthly quota and current consumption are visible on your usage page, so overage isn't a surprise at the end of the month.
Which models answer my questions?
The Co-Analyst runs on the platform's own retrieval stack, and answers are grounded in your retained corpus with citations rather than generated from memory. Retrieval infrastructure is managed by us, and for KSA-region tenants processing stays on KSA infrastructure.

Give your tools a real brain.

One Bearer key. Twelve endpoints. Evidence chains under every answer. Get building in under five minutes.

Sign up free →Sign in
# install
$ npm i @omni-intel/sdk

# or
$ pip install omni-intel

# first call
$ export OMNI_INTEL_KEY=oint_live_xxxx
$ curl https://api.omniintel.example/v1/enrich/1.2.3.4 \
-H "Authorization: Bearer $OMNI_INTEL_KEY"