Quick start
Paste everything you know in the big box: domains, emails, GitHub handles, org names, what you want checked (breaches, lookalikes). Umbra builds an IntentPlan. Nothing hits the network until you click Confirm & run.
brand example.com GH octocat [email protected] check lookalikes and breaches
Authorization
Every search needs a basis. Use this tool only for assets you own, client-authorized work, public CTI, or training on public data.
own_asset— your brand, domains, accountsclient_engagement— contracted scopepublic_cti— malware infra / public indicatorstraining_lab— learning on public examples
Google-style dorks (for the Intent box)
Umbra is not Google — but you can paste dork-like lines so the planner picks up identifiers and flags. Combine with real identifiers.
Site & domain
site:example.com domain:example.com inurl:admin example.com lookalikes for example.com typosquat watch example.com
Email & breach
email [email protected] breach check [email protected] hibp [email protected] pwned / compromised credentials for [email protected]
Usernames & social
github:octocat GH carlsullivan11 https://github.com/octocat linkedin.com/in/someone @handle username probe everywhere octocat
Org / filings
company: Acme Robotics org Acme LLC edgar filings corp records Acme
Historical / web
wayback example.com archive.org example.com web search Acme Robotics Bentonville
Example “dork pack” intents
# Brand defense domain example.com lookalikes typosquat brand abuse [email protected] breach check # Person footprint (authorized) person Jane Doe company Example Corp github:janedoe email [email protected] location Bentonville AR # Infra 8.8.8.8 example.com wayback example.com
Flags the planner understands
| Say something like… | Flag | Collectors |
|---|---|---|
| lookalike, typosquat, brand abuse | want_lookalikes | lookalike_domains |
| breach, pwned, hibp, leaked | want_breaches | hibp_breach |
| edgar, llc, corp records | want_corp_records | wikidata, edgar, opencorporates… |
| username everywhere, sherlock | aggressive_username_probe | username_presence |
| wayback, archive.org | want_wayback | wayback_cdx |
| google, web search | want_web_search | ddg_search |
Advanced CLI
# Deterministic plan umbra intent "example.com gh octocat breaches" -b own_asset # LLM enrich (LocalAI / OpenAI-compatible) export UMBRA_LLM_BASE_URL=http://127.0.0.1:8080/v1 export UMBRA_LLM_MODEL=your-model umbra intent "messy notes…" -b client_engagement --llm # Execute from CLI umbra intent "…" -b own_asset --confirm # After a case exists umbra entities <case_id> umbra score <case_id> umbra profile <case_id> umbra entity verify <entity_id> -s true umbra watch add -t domain -v example.com -c <case_id> umbra breach password umbra breach email [email protected]
LLM planner
Optional. Deterministic extractors always run first; the model only merges extra structure. Set UMBRA_LLM_* env vars. UI dropdown: Auto / Deterministic / Force LLM.
Confidence & verify
After a run, entities get multi-factor scores (high / medium / low / speculative). Mark truth with umbra entity verify. Verification overrides scores.
Ethics
No dark-web market scrapers. No silent doxxing chat. Breach data via HIBP. See docs/ETHICS.md in the repo.
Docs in repo
docs/INTENT-SEARCH.mddocs/COLLECTORS.mddocs/SCORING.mddocs/DEPLOYMENT.mddocs/BREACH-AND-MONITORING.md