Open source
Your data, your server
Run NornOps on your own infrastructure with Docker. Unlimited usage with your API keys — every line of product code is in the public repo.
Install from GitHub →NornOps
The IOC workbench you actually own.
Normalize, enrich, and score indicators — then keep the investigation in cases. Self-host it, or let us run Cloud for you.
Hosted
Don't want to run a server?
NornOps Cloud is the same workbench, operated for you — Free to start, then Starter or Pro when your daily enrich and AI volume grows.
Create a Cloud account →Built for the triage loop
One place to enrich indicators, read a verdict, and park the work in a case — without swapping tools mid-investigation.
-
Multi-source enrichment
VirusTotal, AbuseIPDB, GreyNoise, OTX, ThreatFox, URLhaus — one normalize-and-score pass.
-
Cases that stick
Keep IOC snapshots, notes, and tags with the investigation — not scattered across tabs.
-
Path Encyclopedia
Turn Windows paths into KB-backed context: LOLBAS, GTFOBins, software identity, reputation.
-
Community tips
Browse and publish indicators across organizations when you want the feed to grow.
Frequently asked
- What is NornOps?
- An open-source threat intelligence workbench for SOC analysts. Normalize and enrich IOCs, score verdicts, and track investigations as cases.
- Is self-host free?
- Yes. The public project is free to run on your own infrastructure with your own API keys. No quotas.
- What is NornOps Cloud?
- A hosted edition we operate for you — same product, with plan-based quotas, Stripe billing, and keys we manage. Start free, upgrade when you need more.
- Can I move between them?
- Self-host and Cloud share the same product surface. Start hosted to evaluate, or clone the repo when you want full control.