IoC management · Part of Lutpod
Read the signs
before the breach.
Omenra collects indicators from every feed you trust, scores how much to believe them, and tells you the moment one shows up on your own hosts.
The Threat Graph: pick a malware family, actor or campaign and see its indicators, the hosts that touched them and the threats they share.
How it works
From a feed to a hit,
without the spreadsheet.
Every indicator goes through the same five steps. Each step runs as its own service, so a slow feed never holds up correlation.
- 1
Collect
Pulls from feeds on a schedule and takes submissions from analysts, scripts and partners.
MISP · AlienVault OTX · abuse.ch · TAXII 2.1 · HTTP lists · REST API
- 2
Normalize
Refangs, validates and deduplicates values, so the same IP from three feeds is one indicator.
13 types: IPv4/6, CIDR, domain, URL, MD5, SHA1, SHA256, email, file name, JA3, ASN, CVE
- 3
Score
Combines each source's confidence with its reliability, then ages the result as the indicator goes stale.
Admiralty A–F reliability · TTL decay · whitelists
- 4
Correlate
Matches indicators against what your sensors actually saw and opens one hit per indicator, not one per event.
Elastic SIEM sightings · Dossio cases · API
- 5
Share
Pushes what's worth blocking to the tools that block it, filtered by score, type and TLP.
Elastic Security · TAXII 2.1 server · firewall EDL · webhooks
Scoring
A score you can explain.
When a junior analyst asks why an IP is critical, the answer is on screen: which sources reported it, how far each one is trusted, and whether it was seen inside.
- Independent sources raise the score faster than one source repeating itself.
- A sighting on your own hosts counts for more than any external report.
- Network indicators lose weight after half their TTL, so last year's C2 stops paging people.
Reported by
How it's calculated: 1 − ∏(1 − confidence × reliability), plus 5 per extra source (up to 15) and 10 per sighting (up to 30). After half the TTL the score decays linearly, down to a floor of 20%.
Daily work
Quiet until it matters.
An IoC management platform earns trust by not crying wolf. Omenra suppresses what you already know is safe and groups the rest into a queue you can clear.
One hit per indicator, with its full story.
Repeated sightings update the open hit instead of creating new ones. Severity follows the score, and the hit keeps the time it was first seen.
Never block your own CDN.
Suppress by exact value, domain suffix, CIDR range or regex. Whitelisted indicators stay searchable but never alert.
Paste a report, get the IoCs.
Drop in an email or an advisory. Omenra pulls out defanged values like hxxp://evil[.]com and checks them against the store.
Indicators belong to threats.
Malware families, actors, campaigns, MISP events and Dossio cases group indicators so one sighting exposes the whole cluster.
Keys for machines, roles for people.
Analysts sign in with roles. Scripts, SOAR and partners use scoped API keys you can revoke at any time.
Deploy
Your servers.
Your data.
Omenra runs on one Linux VM or Docker Desktop. Nothing leaves your network except the feed requests you configure.
# unpack the release and start everything tar xzf omenra-v1.2.0-linux-x64.tar.gz cd omenra-v1.2.0-linux-x64 docker compose up -d # first start prints the admin password docker compose logs init # open https://localhost:8443
Secrets generated for you
The first start creates the master key, JWT secret and admin password. Feed and integration credentials are stored with AES-256-GCM.
Isolated by default
The database and queue sit on an internal network with no route out. Only the ingestor and connector can reach the internet.
Shipped as a binary
Services ship as one compiled, obfuscated binary. HTTPS works on first boot with a self-signed certificate you can replace.
See what your feeds already know.
Omenra is in early access for SOC and MSSP teams. Tell us about your environment and we'll get you a build.