Umbra

Graph-first OSINT for authorized investigations. Umbra connects public data sources into a provenance-backed entity graph, scores confidence, and watches for change — locally, from the command line, with no account and no API keys required for most of it.

Lawful use only. Every case records an authorization_basis for audit. Umbra is passive and defensive: it does not crawl criminal marketplaces, buy stolen data, or provide intrusion capability. Read the acceptable use policy before you start.

pip install umbra-osint
umbra init      # data directory + ethics acknowledgement
umbra doctor    # verify the install before relying on it

The distribution is umbra-osint; the import package and the commands are umbra and umbra-worker.

What it does

umbra intent "example.com"          # free text -> a plan you can review
umbra case create -n acme -b own_asset
umbra run <case-id> -d 1            # collect, pivot, score
umbra profile <case-id>             # markdown profile with provenance
umbra graph <case-id> -o acme.graphml

• 32 plugin collectors, most of them key-free — DNS, TLS, RDAP, HTTP, Certificate Transparency, git forges, SPARQL, HTML.
• Entity graph across domain, ip, email, url, username, org, person, location, vulnerability, malware, cert, asn, mac, repo, technology, breach.
• Confidence scoring — multi-factor bands, recomputed after every run, with every claim traceable to the evidence that produced it.
• Owned data lakes — Umbra ingests primary sources it can then query with no external API: Certificate Transparency, the IEEE OUI registry, CISA KEV, and the abuse.ch malware feeds.
• Cyber wiki — a 3.6k-page corpus with exact-identifier lookup (umbra lookup CVE-2021-44228).
• Watchlist monitor — DNS/HTTP snapshots and diffs, cron-friendly.
• Exports — markdown profile, GraphML, and a full JSON case bundle.

Local-first: SQLite under ~/.umbra by default, Postgres when you point UMBRA_DATABASE_URL at one.

Honest limits

• Absence of a finding is not a clean result. When a source is unreachable Umbra says so rather than reporting nothing found — blocklists, certificate logs and vulnerability data are all treated this way, on purpose.
• DNS blocklists need a local recursive resolver. Queried through a public resolver (1.1.1.1, 8.8.8.8) they refuse the query and answer in a way that looks like a listing for every address. umbra doctor checks this.
• The hosted web application is not in this package. The CLI is the open core; the hosted product runs at umbra-osint.com.

Requires

Python 3.11+. MIT licensed.

• Guide
• Cyber wiki
• Acceptable use · Terms · Privacy