SOC kernel online · 9 engines · SHA-256 sealed

Know who's behind

From raw signal to court-ready intelligence in minutes. Osinara turns fifteen browser tabs into one scoped case — enriched, hashed, correlated and reported.

9
intel engines
15
MCP tools
17
RLS tables
2
export formats
CASE-2026-0881
TLP:AMBERRESTRICTED
Subject dossier
Ransomware C2
Risk
0/100
Domain: mal-c2[.]netIP: 185.220.101.5Actor: LockNet affiliate
VirusTotal48/72 engines malicious
Shodan443, 8443 · Cobalt Strike beacon
AbuseIPDB100% confidence · 1,284 reports
crt.sh6 wildcard certs in 48h
Chain of custody · SHA-256

Fused intelligence from trusted sources

VT
VirusTotal
90+ AV engines
SH
Shodan
Device & port intel
AB
AbuseIPDB
IP abuse confidence
US
urlscan.io
Live page capture
IP
IPinfo
ASN & geolocation
CT
crt.sh
Certificate logs
RD
RDAP
Registry records
DoH
DNS-over-HTTPS
Private resolution
HB
HIBP
Breach exposure
VT
VirusTotal
90+ AV engines
SH
Shodan
Device & port intel
AB
AbuseIPDB
IP abuse confidence
US
urlscan.io
Live page capture
IP
IPinfo
ASN & geolocation
CT
crt.sh
Certificate logs
RD
RDAP
Registry records
DoH
DNS-over-HTTPS
Private resolution
HB
HIBP
Breach exposure

Investigate across the spectrum

Four dimensions. One workspace.

A workspace built around the case, not the search.

Lifecycle stages, task delegation, members with case roles and a chronological timeline — every artifact belongs somewhere.

Intake
Triage
Enrichment
Correlation
Reporting
Closure
Tasks
Enrich 14 IOCsA. Rahman
Pivot registrant emailJ. Chen
Draft executive briefM. Silva
Timeline
09:14Phishing email reported
09:41Domain enriched · 7 VT hits
10:02Evidence sealed · SHA-256
10:30Linked to CASE-0098

Built for depth

Evidence that holds up. Analysis that connects.

Cross-case link analysis

Shared IOCs light up across investigations automatically — spot campaigns, not just incidents.

RESOLVES_TOUSESSHARED_IOCCASE-0881mal-c2.net185.220.101.5Subject T-207n3on@proton.meCASE-0098

Cryptographic evidence locker

Every upload is SHA-256 hashed on ingest with collector, source and timestamp.

phishing_kit.zip · 2.4 MB
hashing…

Automated risk scoring

Severity × confidence rolls findings into one defensible score.

0/100
Critical × Confirmed
4 findings weighted

Native MCP endpoint for AI agents

15 authenticated tools let Claude, Cursor and SOC copilots search cases, run lookups and log findings.

// Manual OSINT

  • 15 browser tabs per indicator
  • Screenshots lost in Downloads
  • No proof evidence wasn't altered
  • 4 hours formatting a Word report

// The Osinara standard

  • One search, nine engines, one case
  • Every artifact hashed and logged
  • Automatic cross-case correlation
  • One-click PDF & DOCX reports

Security by design

Restricted by default.

Sensitive investigations stay with the people assigned to them — enforced at the data layer, logged at every step.

TLP 2.0Chain of custodyLeast privilegeAudit trail
Role-based access

Admin, Investigator, Analyst and Viewer roles plus per-case membership.

Row-level isolation

Users only ever see cases they belong to.

Tamper evidence

SHA-256 hashing for every uploaded artifact.

SSRF-safe analyzers

Private and reserved networks blocked server-side.

Complete audit log

Logins, case changes, uploads and exports — CSV export.

Authenticated AI access

MCP tools require sign-in and respect your permissions.

Start your next investigation.

Open a case, add a target and watch Osinara connect the dots.

Start investigating