Skip to content

Commit

Permalink
Merge pull request #4 from rshipp/master
Browse files Browse the repository at this point in the history
Fix typos, make small wording changes
  • Loading branch information
deadbits committed May 22, 2018
2 parents 202f3f1 + 99cc04a commit 65f6251
Showing 1 changed file with 18 additions and 18 deletions.
36 changes: 18 additions & 18 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# OSINT Omnibus
![Release](https://img.shields.io/badge/Release-Alpha-blue.svg)
![Release](https://img.shields.io/badge/Release-Alpha-blue.svg)
Provided by [InQuest](https://www.inquest.net)

Table of Contents
Expand All @@ -25,7 +25,7 @@ Table of Contents

Provided by [InQuest](https://www.inquest.net)

There will be some bugs as this is a very early release of the application (pre-alpha). If you do happen to use notice any modules that fail or other bugs, please create an Issue and/or Pull Request. Both are more than welcome as we'd love to expand this framework as we go on!
There will be some bugs as this is a very early release of the application (pre-alpha). If you do happen to notice any modules that fail or other bugs, please create an Issue and/or Pull Request. Both are more than welcome as we'd love to expand this framework as we go on!

## Omnibus
An Omnibus is defined as `a volume containing several novels or other items previously published separately` and that is exactly what the InQuest Omnibus project intends to be for Open Source Intelligence collection, research, and artifact management.
Expand All @@ -39,46 +39,46 @@ The application is written with Python 2.7 in mind and has been successfully tes
As this is a pre-release of the final application, there will very likely be some bugs and uncaught exceptions or other weirdness during usage. Though for the most part, it is fully functional and can be used to begin OSINT investigations right away.

### Contribution
Omnibus is built in a modular manner that allows the easy addition, or removal, of OSINT plugins. Each module is included in a single directory and by adding a few lines of code, you're module could be the next one!
Omnibus is built in a modular manner that allows the easy addition, or removal, of OSINT plugins. Each module is included in a single directory, and by adding a few lines of code, your module could be the next one!

As this README and the Wiki continues to grow, we will have full-fledged examples of how to write custom plugins and get them in as Pull Requests!

### Vocabulary
Before we begin we'll need to cover some terminology used by Omnibus.

* Artifact:
* Artifact:
- An item to investigate
- Artificats can be created in two ways:
- Using the `new` command or by being discoverd through module execution
* Session:
- Cache of artifacts created after starting the Omnibus CLI
- Each artifact in a session is given an ID to quickly identify and retrieve the artifact from the cache
- Commands can be executed against an artifact either by providing it's name or it's corresponding session ID
* Module:
* Module:
- Python script that performs some arbitirary OSINT task against an artifact

### Running Omnibus
Starting up Omnibus for investigation is a simple as cloning this GitHub repository, install the Python requirements using `pip install -r requirements.txt` and then running `python2.7 omnibus-cli.py`.
Starting up Omnibus for investigation is a simple as cloning this GitHub repository, installing the Python requirements using `pip install -r requirements.txt` and running `python2.7 omnibus-cli.py`.

**Omnibus Shell - Main Startup**
![Alt text](docs/images/omnishell.png?raw=true "Shell")

For a visual reference of the CLI, pictured above is the Omnibus console after a new session has been started, 2 artifacts have been added to a session, and the `help` menu is shown.

#### API Keys
You must set any API keys you'd like to use within modules inside the `omnibus/etc/apikeys.json` file.
This file is a JSON ocument and has placeholders for all the services which require API keys, and is only accessed by Omnibus on a per module basis to retrieve the exact API key a module needs to execute.
You must set any API keys you'd like to use within modules inside the `omnibus/etc/apikeys.json` file.
This file is a JSON ocument with placeholders for all the services which require API keys, and is only accessed by Omnibus on a per module basis to retrieve the exact API key a module needs to execute.

It should be noted that most of the services requiring API keys have free accounts and API keys. Some free accounts may have lower resource limits, but that hasn't been a problem during smaller daily investigations or testing the application.

**A handy tip** is using the `cat apikeys` command to view which keys you do in fact have stored.
If modules are failing, check here first to ensure your API key is properly saved.
**A handy tip**: Use the `cat apikeys` command to view which keys you do in fact have stored.
If modules are failing, check here first to ensure your API key is properly saved.

### Interactive Console
When you first run the CLI, you'll be greeted by a help menu with some basic information. We tried to build the command line script attempts to mimic some common Linux console commands for ease of use. Omnibus provides commandssuch as `cat` to show information about an artifact, `rm` to remove an artifact from the database, `ls` to view currently session artifacts, and so on.
When you first run the CLI, you'll be greeted by a help menu with some basic information. We tried to build the command line script to mimic some common Linux console commands for ease of use. Omnibus provides commands such as `cat` to show information about an artifact, `rm` to remove an artifact from the database, `ls` to view currently session artifacts, and so on.

One additional feature of note is the use of the `>` character for output redirection. For example, if you wish to retrieve the details of an artifact named "inquest.net" saved to a JSON file on your local disk you'd simply run the command:
`cat inquest.net > inquest-report.json` and there it would be! This feature also works with full file paths instead of simply local.
`cat inquest.net > inquest-report.json` and there it would be! This feature also works with full file paths instead of relative paths.

The high level commands you really need to know to use Omnibus are:
* `session`
Expand Down Expand Up @@ -112,7 +112,7 @@ Also, if you ever need a quick reference on the different commands available for
#### Overview
Most cyber investigations begin with one or more technical indicators, such as an IP address, file hash or email address. After searching and analyzing, relationships begin to form and you can pivot through connected data points. These data points are called Artifacts within Omnibus and represent any item you wish to investigate.

Artifacts can be one of the following types:
Artifacts can be one of the following types:
* IPv4 address
* FQDN
* Email Address
Expand All @@ -121,13 +121,13 @@ Artifacts can be one of the following types:
* User Name

#### Creating & Managing Artifacts
The command "new" followed by an artifact will create that artifact within your Omnibus session and store a record of the artifact within MongoDB. This record holds the artifact name, type, subtype, module results, source, notes, tags, children information (as needed) and time of creation.
The command "new" followed by an artifact will create that artifact within your Omnibus session and store a record of the artifact within MongoDB. This record holds the artifact name, type, subtype, module results, source, notes, tags, children information (as needed) and time of creation.
Every time you run a module against a created or stored artifact, the database document will be updated to reflect the newly discovered information.

To create a new artifact and add it to MongoDB for tracking, run the command `new <artifact name>`. For example, to
start investigation the domain deadbits.org, you would run `new deadbits.org`.

Omnibus will automatically determine what type the artifact is and ensures that only modules for that type are executed against the artifact.
Omnibus will automatically determine what type the artifact is and ensure that only modules for that type are executed against the artifact.

When a module is created, new artifacts may be found during the discovery process. For example, running the "dnsresolve" command might find new IPv4 addresses not previously seen by Omnibus. If this is the case, those newly found artifacts are automatically created as new artifacts in Omnibus and linked to their parent with an additional field called "source" to identify from which module they were originally found.

Expand All @@ -138,9 +138,9 @@ Omnibus makes use of a feature called "sessions". Sessions are temporary caches
For example if you're session held one item of "inquest.net", instead of needing to execute `virustotal inquest.net` you could also run `virustotal 1` and you would receive the same results. In fact, this works against any module or command that uses an artiface name as it's first argument.

Sessions are here for easy access to artifacts and will be cleared each time you quit the command line session.
If you wish to clear the session early, run the command "wipe" and you'll get clean slate.
If you wish to clear the session early, run the command "wipe" and you'll get a clean slate.

Eventually, we would like to add a **Cases** portion to Omnibus that allows users to create cases of artifacts, move between them, and maintain a more coherent OSINT management platform. Though for this current pre-release, we will be sticking with the Session :)
Eventually, we would like to add a **Cases** portion to Omnibus that allows users to create cases of artifacts, move between them, and maintain a more coherent OSINT management platform. Though for this current pre-release, we will be sticking with the Session. :)

**Interacting with Session IDs instead of Artifact names**
![Alt text](docs/images/artifact_id.png?raw=true "Shell")
Expand All @@ -150,7 +150,7 @@ Eventually, we would like to add a **Cases** portion to Omnibus that allows user
Omnibus currently supports the following list of modules. If you have suggestions or modules or would like to write one
of your own, please create a pull request.

Also, within the Omnibus console, type the module name will show you the Help information associated with that module.
Also, within the Omnibus console, typing the module name will show you the Help information associated with that module.

**Modules**
- Blockchain.info
Expand Down

0 comments on commit 65f6251

Please sign in to comment.