What OmniIntel is.

OmniIntel ingests threat data from upstream open-source and commercial feeds, plus whatever you submit yourself, and reconciles it into one canonical record per entity. It keeps the provenance of every claim — which source said it, when it was fetched, how confident that source is — and it keeps that provenance attached all the way through to the answer. A SIEM, SOAR, EDR or scanner talks to it over a typed REST API or pulls STIX 2.1 objects from TAXII 2.1 collections. Everything is scoped to a tenant, and isolation is enforced by the database rather than by application code.

The distinction that matters: a feed hands you a list and leaves the judgement to you. OmniIntel is built so that you can always ask why — and get an answer that points at a specific retained document.

Six stages. Each page below covers one part of this in depth; the end-to-end pipeline page walks the whole path with the tables and services named at each step.

• ▸10 upstream connectors on per-connector cadences — abuse.ch (URLhaus, ThreatFox, MalwareBazaar), AlienVault OTX, CISA KEV, EPSS, GitHub GHSA, NVD, MITRE ATT&CK, ransomware.live.
• ▸67 tables in one Postgres with pgvector. 14 of them carry FORCE ROW LEVEL SECURITY — those are the tenant-scoped ones.
• ▸Five canonical entity types — indicators, vulnerabilities, actors, malware and MITRE attack patterns — plus a knowledge base and a CTI graph over them.
• ▸22 mounted route groups on the public API gateway, and official TypeScript and Python SDKs.
• ▸Six organisation roles mapped to a 16-entry capability catalogue, checked server-side at the point of use.