Omnibus
An Omnibus is defined as a volume containing several novels or other items previously published separately and that is exactly what the InQuest Omnibus project intends to be for Open Source Intelligence collection, research, and artifact management.
By providing an easy to use interactive command line application, users are able to create sessions to investigate various artifacts such as IP addresses, domain names, email addresses, usernames, file hashes, Bitcoin addresses, and more as we continue to expand.

This project has taken motivation from the greats that came before it such as SpiderFoot, Harpoon, and DataSploit. Much thanks to those great authors for contributing to the world of open source.

The application is written with Python 2.7 in mind and has been successfully tested on OSX and Ubuntu 16.04 environments.
As this is a pre-release of the final application, there will very likely be some bugs and uncaught exceptions or other weirdness during usage. Though for the most part, it is fully functional and can be used to begin OSINT investigations right away.

Artifacts
Most cyber investigations begin with one or more technical indicators, such as an IP address, file hash or email address. After searching and analyzing, relationships begin to form and you can pivot through connected data points. These data points are called Artifacts within Omnibus and represent any item you wish to investigate.

Artifacts can be one of the following types:
+ IPv4 address
+ FQDN
+ Email Address
+ Bitcoin Address
+ File Hash (MD5, SHA1, SHA256, SHA512)
+ User Name

Creating & Managing Artifacts
The command “new” followed by an artifact will create that artifact within your Omnibus session and store a record of the artifact within MongoDB. This record holds the artifact name, type, subtype, module results, source, notes, tags, children information (as needed) and time of creation. Every time you run a module against a created or stored artifact, the database document will be updated to reflect the newly discovered information.
To create a new artifact and add it to MongoDB for tracking, run the command new <artifact name>. For example, to start investigation the domain deadbits.org, you would run new deadbits.org.

Omnibus will automatically determine what type the artifact is and ensures that only modules for that type are executed against the artifact.
When a module is created, new artifacts may be found during the discovery process. For example, running the “dnsresolve” command might find new IPv4 addresses not previously seen by Omnibus. If this is the case, those newly found artifacts are automatically created as new artifacts in Omnibus and linked to their parent with an additional field called “source” to identify from which module they were originally found.

Artifacts can be removed from the database using the “delete” command. If you no longer need an artifact, simply run the delete command and specify the artifacts name or the session ID if it has one.

omnibus

Sessions
Omnibus makes use of a feature called “sessions”. Sessions are temporary caches created via Redis each time you start a CLI session. Every time you create an artifact, that artifacts name is added to the Session along with a numeric key that makes for easy retrieval, searching, and action against the related artifact. For example if you’re session held one item of “inquest.net”, instead of needing to execute virustotal inquest.net you could also run virustotal 1 and you would receive the same results. In fact, this works against any module or command that uses an artiface name as it’s first argument.

Sessions are here for easy access to artifacts and will be cleared each time you quit the command line session. If you wish to clear the session early, run the command “wipe” and you’ll get clean slate.
Eventually, we would like to add a Cases portion to Omnibus that allows users to create cases of artifacts, move between them, and maintain a more coherent OSINT management platform. Though for this current pre-release, we will be sticking with the Session

Modules
Omnibus currently supports the following list of modules. If you have suggestions or modules or would like to write one of your own, please create a pull request.

Also, within the Omnibus console, type the module name will show you the Help information associated with that module.
Modules:
– Blockchain.info
– Censys
– ClearBit
– Cymon
– DNS subdomain enumeration
– DNS resolution
– DShield (SANS ISC)
– GeoIP lookup
– Full Contact
– Gist Scraping
– GitHub user search
– HackedEmails.com email search
– Hurricane Electric host search
– HIBP search
– Hunter.io
– IPInfo
– IPVoid
– KeyBase
– Nmap
– PassiveTotal
– Pastebin
– PGP Email and Name lookup
– RSS Feed Reader
– Shodan
– Security News Reader
– ThreatCrowd
– ThreatExpert
– TotalHash
– Twitter
– URLVoid
– VirusTotal
– Web Recon
– WHOIS

As these modules are a work in progress, some may not yet work as expected but this will change over the coming weeks as we hope to officially release version 1.0 to the world!

Machines
Machines are a simple way to run all available modules for an artifact type against a given artifact. This is a fast way if you want to gather as much information on a target as possible using a single command.

To perform this, simply run the command machine <artifact name|session ID> and wait a few minutes until the modules are finished executing.
The only caveat is that this may return a large volume of data and child artifacts depending on the artifact type and the results per module. To remedy this, we are investigating a way to remove specific artifact fields from the stored database document to make it easier for users to prune unwanted data.

Use and Download:

git clone https://github.com/InQuest/omnibus && cd omnibus
pip install -r requirements.txt
python omnibus-cli.py

Source: https://github.com/InQuest