I have no data yet. It is a capital mistake to theorize before one has data. Insensibly one begins to twist facts to suit theories, instead of theories to suit facts.
The official default plugin collection for OMOIKA. A graph-based, local-first OSINT platform for recon, link analysis, and open-source investigations.
This repository contains the default entities (node types) and transforms (graph/data operations) that ship with OMOIKA. It is built on top of the omoika framework package.
Status: Experimental. Entity definitions and transform signatures may change suddenly and without warning.
An almost incomprehensible amount of data is created every day. OSINT is a method of working with, assessing, and ranking that information but the sheer volume and lack of structure leaves us drowning. OMOIKA is an open-source, desktop app designed to help you cut through the noise with a graph-based interface that turns data relationships into clear visualizations, and a plugin system that lets you pull from any data source you can imagine.
The core ideas:
- Visual intelligence: complex data relationships rendered as interactive graphs
- Extensible plugins: define your own entities and transforms in Python
- Local-first: your data stays under your control, no cloud dependencies required outside of whatever you choose to do with plugins
Entities are the nodes in the graph. Each entity type is a Python class that defines:
- What the node represents (person, IP address, domain, etc.)
- What fields it holds and how they're displayed
- Metadata like icon, color, and category
Transforms are operations on entities that produce new entities (edges in the graph). They appear in the right-click context menu on any node. A transform might:
- Resolve a domain to its IP addresses
- Look up WHOIS data for a domain
- Extract the domain from an email address
- Search for a username across platforms
Both entities and transforms are built with the omoika framework package. See the framework README and its docs/ for the full API reference.
These plugins are loaded automatically by the OMOIKA application for standalone use and demonstration purposes. Feel free to fork and improve anything you desire, we're open to community contributions in this repo :)
MIT.
See LICENSE for details.
- OMOIKA Releases
- Plugins Repository
- Plugins Issue Tracker
- Electron Issue Tracker
- Framework Issue Tracker
| Entity | ID | Category | Description | File |
|---|---|---|---|---|
| Airport | [email protected] | Locations, Transportation | Represent an airport (IATA/ICAO codes and name). | entities/airport.py |
| Ammunition | [email protected] | Weapons | Represent ammunition type and caliber. | entities/ammunition.py |
| Autonomous System | [email protected] | Network | Represent an Autonomous System (ASN). | entities/autonomous_system.py |
| Bad Guy | [email protected] | Identity | Represent a suspect or hostile individual. | entities/bad_guy.py |
| Bank Account | [email protected] | Finance, Identity | Represent a bank account identifier. | entities/bank_account.py |
| Bike | [email protected] | Transportation | Represent a bicycle with make/model. | entities/bike.py |
| Bitcoin Address | [email protected] | Cryptocurrency | Represent a Bitcoin address. | entities/bitcoin_address.py |
| Blade | [email protected] | Weapons | Represent an edged weapon (knife/machete). | entities/blade.py |
| Boat | [email protected] | Transportation | Represent a watercraft registration. | entities/boat.py |
| Breach Data | [email protected] | Threat Intelligence, Documents | Reference breached data sources or upload small snippets. | entities/breach_data.py |
| Bus | [email protected] | Transportation | Represent a bus vehicle identifier. | entities/bus.py |
| Business Leader | [email protected] | Identity, Organizations | Represent an executive or business leader. | entities/business_leader.py |
| Business Man | [email protected] | Identity, Organizations | Represent a businessman or professional. | entities/business_man.py |
| Car | [email protected] | Transportation | Represent an automobile. | entities/car.py |
| Certificate Transparency | [email protected] | Web | Represent a CT log entry or lookup. | entities/certificate_transparency.py |
| Chemical Weapon | [email protected] | Weapons | Represent a chemical weapon classification. | entities/chemical_weapon.py |
| Child | [email protected] | Identity | Represent a child (basic demographics). | entities/child.py |
| Church | [email protected] | Organizations | Represent a church or religious building. | entities/church.py |
| City | [email protected] | Locations | Represent a city. | entities/city.py |
| Cloud Bucket | [email protected] | Web | Represent a cloud storage bucket (S3/GCS/Azure). | entities/cloud_bucket.py |
| Company | [email protected] | Organizations | Represent a company or organization entry. | entities/company.py |
| Company Profile | [email protected] | Organizations, Documents | Store basic company/organization details. | entities/company_profile.py |
| Computer | [email protected] | Devices | Represent a computer asset. | entities/computer.py |
| Conversation | [email protected] | Communications | Represent a conversation reference. | entities/conversation.py |
| Conversation Email | [email protected] | Communications | Represent an email thread or subject. | entities/conversation_email.py |
| Conversation Phone | [email protected] | Communications | Represent a phone conversation record. | entities/conversation_phone.py |
| Country | [email protected] | Locations | Represent a country. | entities/country.py |
| Crime Scence | [email protected] | Events, Locations | Represent a crime scene reference (location/time). | entities/crime_scence.py |
| Crypto Transaction | [email protected] | Cryptocurrency, Finance | Represent a blockchain transaction (hash/network). | entities/crypto_transaction.py |
| Darkweb Service | [email protected] | Web | Represent a darkweb/onion service reference. | entities/darkweb_service.py |
| DeFi Contract | [email protected] | Cryptocurrency, Finance | Represent a smart contract (address/network). | entities/defi_contract.py |
| Desktop Computer | [email protected] | Devices | Represent a desktop computer asset. | entities/desktop_computer.py |
| Device | [email protected] | Devices | Represent a generic device. | entities/device.py |
| DNS | [email protected] | Network | The Domain Name System translates domains into IPs | entities/dns.py |
| DOI | [email protected] | Documents | A a digital identifier of an object, any object; physical, digital, or abstract. DOIs solve a common problem: keeping track of things. | entities/doi.py |
| Drug Dealer | [email protected] | Identity | Represent a suspected drug dealer. | entities/drug_dealer.py |
| Education Instituion | [email protected] | Organizations | Represent an educational institution. | entities/education_instituion.py |
| Email Address | [email protected] | Identity, Communications | Represent and store an email address. | entities/email_address.py |
| Ethereum Address | [email protected] | Cryptocurrency | Represent an Ethereum address. | entities/ethereum_address.py |
| Event | [email protected] | Events | Represent an event occurrence. | entities/event.py |
| Explosive | [email protected] | Weapons | Represent an explosive material or device. | entities/explosive.py |
| Favicon Hash | [email protected] | Web | Represent an HTTP favicon hash (e.g., for Shodan/Censys). | entities/favicon_hash.py |
| Female | [email protected] | Identity | Represent a female person. | entities/female.py |
| File | [email protected] | Documents | Attach a generic file and metadata. | entities/file.py |
| File Hash | [email protected] | Documents, Threat Intelligence | Represent a file hash (MD5/SHA1/SHA256). | entities/file_hash.py |
| Flight Number | [email protected] | Transportation | Represent an airline flight number. | entities/flight_number.py |
| Gang | [email protected] | Organizations | Represent a gang or criminal group. | entities/gang.py |
| Gang Leader | [email protected] | Identity | Represent a gang leader. | entities/gang_leader.py |
| Gang Member | [email protected] | Identity | Represent a gang member. | entities/gang_member.py |
| Good Guy | [email protected] | Identity | Represent an ally or friendly individual. | entities/good_guy.py |
| Government Official | [email protected] | Identity | Represent a government official. | entities/government_official.py |
| Gun | [email protected] | Weapons | Represent a firearm (make/model/serial). | entities/gun.py |
| Harbor | [email protected] | Locations, Transportation | Represent a harbor or port location. | entities/harbor.py |
| Home | [email protected] | Locations | Represent a residence address. | entities/home.py |
| HTTP Headers | [email protected] | Web | Represent HTTP response headers for a URL. | entities/http_headers.py |
| Identification Number | [email protected] | Identity | Represent a government-issued ID number. | entities/identification_number.py |
| IED | [email protected] | Weapons | Represent an improvised explosive device. | entities/ied.py |
| Incident | [email protected] | Events | Represent a security or criminal incident. | entities/incident.py |
| IOC Indicator | [email protected] | Threat Intelligence | Represent an Indicator of Compromise (type/value). | entities/ioc_indicator.py |
| IP | [email protected] | Network | Internet Protocol address | entities/ip.py |
| IP Geolocation | [email protected] | Network, Locations | entities/ip_geolocation.py | |
| JavaScript | [email protected] | Web | Represent a JavaScript resource reference. | entities/javascript.py |
| Judge | [email protected] | Identity | Represent a judge. | entities/judge.py |
| Law Officer | [email protected] | Identity | Represent a law enforcement officer. | entities/law_officer.py |
| MAC Address | [email protected] | Network | Represent a device MAC address. | entities/mac_address.py |
| Mail Server | [email protected] | Network | Represent an email (MX) server. | entities/mail_server.py |
| Male | [email protected] | Identity | Represent a male person. | entities/male.py |
| Malware Sample | [email protected] | Threat Intelligence, Documents | Store a malware sample (handle with care). | entities/malware_sample.py |
| Meeting | [email protected] | Events | Represent a generic meeting. | entities/meeting.py |
| Meeting Business | [email protected] | Events | Represent a business meeting. | entities/meeting_business.py |
| Meeting Social | [email protected] | Events | Represent a social meeting or gathering. | entities/meeting_social.py |
| Metadata EXIF | [email protected] | Documents | Attach an image and record parsed EXIF fields. | entities/metadata_exif.py |
| Military Officer | [email protected] | Identity | Represent a military officer. | entities/military_officer.py |
| Missile | [email protected] | Weapons | Represent a missile system. | entities/missile.py |
| Mobile Computer | [email protected] | Devices | Represent a laptop or tablet. | entities/mobile_computer.py |
| Mobile Phone | [email protected] | Devices | Represent a mobile handset. | entities/mobile_phone.py |
| Monero Address | [email protected] | Cryptocurrency | Represent a Monero (XMR) address. | entities/monero_address.py |
| Name Server | [email protected] | Network | Represent a DNS nameserver (NS). | entities/name_server.py |
| NFT Asset | [email protected] | Cryptocurrency | Represent an NFT (contract/token ID). | entities/nft_asset.py |
| Office | [email protected] | Locations | Represent an office location. | entities/office.py |
| Onion Service | [email protected] | Web | Represent a Tor hidden service (v3). | entities/onion_service.py |
| Online Group | [email protected] | Social Media, Organizations | Represent an online group or community. | entities/online_group.py |
| Organization | [email protected] | Organizations | Represent an organization entity. | entities/organization.py |
| Passport Number | [email protected] | Identity | Represent a passport number. | entities/passport_number.py |
| PDF Uploads | [email protected] | Documents | Upload a PDF document for analysis or reference. | entities/pdf_file.py |
| Person Profile | [email protected] | Identity | Store basic person profile details. | entities/person_profile.py |
| PGP Key | [email protected] | Documents | Represent a PGP public key reference. | entities/pgp_key.py |
| Phone Number | [email protected] | Identity, Communications | Represent and store a phone number (E.164). | entities/phone_number.py |
| Plane | [email protected] | Transportation | Represent an aircraft. | entities/plane.py |
| Political Movement | [email protected] | Organizations | Represent a political movement. | entities/political_movement.py |
| Ports | [email protected] | Locations, Transportation | Represent a service port and protocol. | entities/ports.py |
| Prison | [email protected] | Locations | Represent a prison or detention facility. | entities/prison.py |
| Region | [email protected] | Locations | Represent a geographic region. | entities/region.py |
| Religious Group | [email protected] | Organizations | Represent a religious group. | entities/religious_group.py |
| robots.txt | [email protected] | Web | Represent a robots.txt reference for a domain. | entities/robots_txt.py |
| Shodan | [email protected] | Search | Represent a Shodan query or result reference. | entities/shodan.py |
| Shop | [email protected] | Organizations | Represent a shop or retail location. | entities/shop.py |
| Smartphone | [email protected] | Devices | Represent a smartphone device. | entities/smartphone.py |
| SSL Certificate | [email protected] | Web | Represent details from an SSL/TLS certificate. | entities/ssl_certificate.py |
| Subdomain | [email protected] | Web | A domain that is a part of another domain | entities/subdomain.py |
| Tracking Codes | [email protected] | Web | Represent website analytics/ads tracking codes. | entities/tracking_codes.py |
| Train | [email protected] | Transportation | Represent a train identifier. | entities/train.py |
| Train Station | [email protected] | Locations, Transportation | Represent a train station. | entities/train_station.py |
| Transport | [email protected] | Transportation | Represent a transport item or reference. | entities/transport.py |
| Transport Hub | [email protected] | Locations, Transportation | Represent a transport hub (airport/station/port). | entities/transport_hub.py |
| Unknown | [email protected] | Generic | Placeholder for unknown/unspecified entities. | entities/unknown.py |
| URL | [email protected] | Web | Uniform Resource Locator, usually starts with https:// | entities/url.py |
| Username | [email protected] | Identity, Social Media | Investigate usernames used as identification | entities/username.py |
| Username Profile | [email protected] | Social Media, Identity | entities/username_profile.py | |
| Vehicle Registration | [email protected] | Transportation | Represent a vehicle registration record. | entities/vehicle_registration.py |
| VIN Number | [email protected] | Transportation | Represent a Vehicle Identification Number. | entities/vin_number.py |
| Weapon | [email protected] | Weapons | Represent a weapon (generic). | entities/weapon.py |
| Website | [email protected] | Web | Represents a domain from a website on the internet | entities/website.py |
| Whois | [email protected] | Web | whois.com allows you to trace the ownership and tenure of a domain name or an IP address | entities/whois.py |
| Transform | Target | Description | File |
|---|---|---|---|
| Extract IP | [email protected] | Extract IP | transforms/dns.py |
| To geolocation | [email protected] | To geolocation | transforms/ip.py |
| To subdomains | [email protected] | To subdomains | transforms/ip.py |
| To website | [email protected] | To website | transforms/ip.py |
| To website | [email protected] | To website | transforms/url_to_website.py |
| To checkuser.vercel.app | [email protected] | To checkuser.vercel.app | transforms/username.py |
| To URL | [email protected] | To URL | transforms/username_profile.py |
| To DNS | [email protected] | To DNS | transforms/website_transforms.py |
| To google | [email protected] | To google | transforms/website_transforms.py |
| To IP | [email protected] | To IP | transforms/website_transforms.py |
| To WHOIS | [email protected] | To WHOIS | transforms/website_transforms.py |
| File | Type | Purpose |
|---|---|---|
| (none) |
Browser automation: Uses selenium Network dependencies: Transforms appear to use network-facing modules: httpx, selenium, socket, urllib Detected external dependencies: httpx, selenium