SOVEREIGN EXPOSURE MANAGEMENT & VULNERABILITY ORCHESTRATION

Discover unmanaged attack surface.
Prioritize real exploits. Verify remediation.

Oolak is an enterprise On-Premise Risk-Based Vulnerability Management (RBVM) and Cyber Asset Attack Surface Management (CAASM) platform. It correlates Tenable scanner outputs with NetBox CMDB asset graphs, enriches findings with CISA KEV and EPSS exploit probability scores, and automates closed-loop verification without sending raw data to the cloud.

Schedule Technical POC → View Supported Integrations

85%

Alert Volume Reduction via KEV + EPSS Filtering

100%

NetBox Bidirectional CMDB Synchronization

3.2x

Faster Mean-Time-to-Remediate (MTTR)

Telemetry Egress (Air-Gapped Sovereign Deployment)

ENTERPRISE TELEMETRY TOPOLOGY

Centralized Exposure Orchestration & Intelligence Flow

Oolak operates as the authoritative On-Premise exposure engine. Ingesting multi-cloud assets, vulnerability scanners, and threat feeds; synchronizing bidirectionally with NetBox, DefectDojo, and ITSM ticketing; enabling conversational AI triage via FastMCP; and dispatching live Grafana dashboards, compliance reports, and ChatOps notifications in real time.

OOLAK DATA FABRIC & INTEGRATION ECOSYSTEM

ACTIVE INGESTION: 10 SOURCES BIDIRECTIONAL SYNC: 3 CORES FASTMCP AI: READY

CORE CAPABILITIES

Architected for High-Density Vulnerability Triage

Legacy vulnerability scanners generate tens of thousands of raw CSV rows per cycle. Oolak ingests scanner data into an actionable, stateful operational backbone.

← Swipe cards horizontally to explore capabilities (CAP_01 – CAP_06) → 6 CAPABILITIES

CAASM CAP_01

NetBox DCIM & IPAM Unification

Dual-layer asset model supporting both Virtual Machines and DCIM Devices. Reconciles raw scanned IPs against NetBox primary IP interfaces, identifying active network hosts missing from the CMDB.

• Orphan Host Detection
• Tenant & Site Scoping
• Interface Connectivity Graph

EXPLOITATION CAP_02

CISA KEV & FIRST EPSS Prioritization

Moves beyond theoretical CVSS severity. Daily synchronization with CISA Known Exploited Vulnerabilities and FIRST EPSS exploit probability scores identifies the 3% of vulnerabilities under active in-the-wild attack.

• In-the-Wild Exploitation Flags
• 30-Day Probability Scoring
• Asset Criticality Weighting

GOVERNANCE CAP_03

SoD Risk Acceptance Register

Four-eyes principle enforced at the authorization layer. Requesters cannot approve their own exceptions. Enforces mandatory expiration dates, risk owner accountability, and compensatory control tracking.

• Separation of Duties (SoD)
• Mandatory Expiry Enforcer
• Regulatory Audit Log Ready

AUTOMATION CAP_04

Automated Rescan & Verification

Eliminates human error when verifying remediations. System operators request rescans; approvers dispatch live Tenable targets via REST API; Oolak verifies resolution before marking findings closed.

• Live Target Scan Dispatch
• Verification Status Queue
• Closed-Loop Remediation

ORCHESTRATION CAP_05

Dynamic Assignment & Triage Rules

Configurable rule engine matching regex, CIDR blocks, plugin IDs, port ranges, and NetBox tags. Features dry-run preview mode calculating match impact before committing rules to production queues.

• Dry-Run Preview Mode
• Multi-Tenant Routing
• Automated WorkTeam Assignment

AI PROTOCOL CAP_06

Anthropic Model Context Protocol (FastMCP)

First-class AI agent integration. Connect Claude Desktop, Cursor, or internal LLM workers via FastMCP with strict parameter boundaries, read-only resources, and two-phase dry-run mutation commits.

• Prompt Injection Sanitizer
• Role-Scoped Token Auth
• Read-Only URI Resources

DETERMINISTIC VULNERABILITY LIFECYCLE

Eliminating Phantom Remediations via ScanCoverage

In traditional vulnerability management, if an endpoint is powered down, offline, or firewalled during a scan cycle, the scanner reports zero findings for that IP. Primitive tools interpret this as a successful remediation and falsely close tickets.

Oolak enforces the ScanCoverage engine: every scanned host—including clean hosts—is logged in the coverage matrix. A missing finding is transitioned to REMEDIATED only if its host was confirmed scanned in that cycle. If the host was offline, the finding remains truthfully OPEN.

STATE: OPEN STATE: REMEDIATED STATE: REOPENED STATE: DECOMMISSIONED

View FindingState Reconciliation Logic & Python Code

# FindingState Lifecycle Reconciliation
def reconcile_finding_lifecycle(cycle_id, host_ip):
  scanned = coverage.is_scanned_in_cycle(cycle_id, host_ip)
  if not scanned:
    # Host offline: Coverage gap. Do NOT close.
    return FindingStatus.OPEN

  if finding.present_in_scan(cycle_id):
    if finding.was_remediated:
      return FindingStatus.REOPENED
    return FindingStatus.OPEN
  else:
    # Confirmed clean scan. Accurate remediation.
    return FindingStatus.REMEDIATED

ENTERPRISE CONNECTIVITY

Comprehensive Integrations Ecosystem

Oolak sits at the core of your security telemetry pipeline, connecting asset repositories, vulnerability scanners, cloud inventory, and monitoring infrastructure.

← Swipe cards horizontally to explore all 19 integrations → 19 INTEGRATIONS

ASSESSMENT

Tenable Security Center & Nessus

Automated report pulling, asset vulnerability parsing, plugin metadata mapping, and live targeted scan dispatch via REST API.

ASSESSMENT

OpenVAS / Greenbone

Open-source vulnerability management connector for scheduled network audits, NVT classification, and air-gapped security assessment.

VULN TRACKING

DefectDojo (Community & Enterprise)

Bidirectional synchronization with DefectDojo engagements, products, findings, and risk acceptance exemptions.

ASSET SOURCE OF TRUTH

NetBox DCIM & IPAM

Full graph synchronization with virtual machines, physical devices, primary IP bindings, untagged VLANs, and tenant access groups.

HYBRID CLOUD

Amazon Web Services (AWS)

Automated cloud inventory harvesting for EC2 instances, security groups, and VPC private networks.

HYBRID CLOUD

Microsoft Azure

Resource discovery across Azure Virtual Machines, network security groups, and virtual network interfaces.

HYBRID CLOUD

Google Cloud (GCP)

Continuous asset inventory ingestion for Compute Engine instances, VPC firewalls, and subnets.

VIRTUALIZATION

VMware & Hyper-V

Automated hypervisor guest discovery via vSphere and WinRM, correlating host virtualization topology with scanned IP addresses.

SIEM & AUDIT

Splunk & RFC 5424 Syslog

Real-time structured syslog emission with RFC 5424 formatting, parameter redaction, and dedicated actor-type classification.

ANALYTICS

Grafana

Real-time vulnerability burndown charts, MTTR analysis, SLA tracking, and multi-tenant security dashboards.

TELEMETRY & HEALTH

Uptime Kuma

Correlates live service availability with open vulnerabilities, monitoring HTTP, TCP, and ICMP heartbeat statuses across scanned endpoints.

OBJECT STORAGE

S3-Compatible Storage

High-availability cluster storage for generated audit spreadsheets, architectural topologies, and immutable evidence archives.

NOTIFICATIONS

Slack

Real-time webhook notifications for critical CISA KEV detections, expiring risk exceptions, and SLA escalation alerts.

NOTIFICATIONS

Microsoft Teams

Interactive Adaptive Card notifications for remediation approvals, four-eyes exception sign-offs, and critical security broadcasts.

AI WORKERS

Anthropic Model Context Protocol

Native FastMCP protocol server allowing AI agents to query asset telemetry and generate remediation draft policies securely.

CONTAINER & SBOM

Trivy Container & SBOM

Ingests container images, Kubernetes manifests, and software bill of materials (SBOM) packages for comprehensive application vulnerability tracking.

SOFTWARE INTEL

Docker & OCI Registries

Direct software intelligence and digest ingestion from internal and air-gapped Docker and OCI container image repositories.

ITSM & TICKETING

Atlassian Jira Software

Bi-directional issue creation, status transition synchronization, and automated ticket closure upon verified scan remediation.

ITSM & CMDB

ServiceNow SecOps

Enterprise change management, SecOps incident dispatch, and Configuration Item (CI) reconciliation for audit governance.

DEPLOYMENT & RESILIENCY

On-Premise & Air-Gapped Resiliency

Containerized Orchestration with Zero External Egress

Oolak is deployed via standard Docker Compose or Kubernetes Helm charts directly into your isolated datacenter. All relational data, scanner artifacts, and asset graphs reside exclusively inside your security perimeter.

In air-gapped defense or banking environments, threat feeds (CISA KEV catalog and FIRST EPSS probability scores) can be loaded offline via signed update bundles or routed through an internal proxy, guaranteeing 100% data sovereignty.

Enterprise Deployment Specifications (6 Controls)

ENTERPRISE DEPLOYMENT SPECIFICATIONS

Deployment Topologies: Docker Compose, Kubernetes Helm (Air-Gapped Ready)

Data Locality: 100% On-Premise; Zero external telemetry or licensing egress

Threat Feed Ingestion: Offline bundle loading or internal forward proxy (CISA KEV, EPSS)

Cryptographic Security: AES-256 data at rest, TLS 1.3 in transit, salted SHA-256 tokens

Access Governance: Role-Based Access Control (RBAC) & Four-Eyes Separation of Duties (SoD)

Audit Export: Real-time RFC 5424 structured syslog streaming with parameter redaction

Discover unmanaged attack surface. Prioritize real exploits. Verify remediation.

Centralized Exposure Orchestration & Intelligence Flow

Architected for High-Density Vulnerability Triage

Eliminating Phantom Remediations via ScanCoverage

Comprehensive Integrations Ecosystem

On-Premise & Air-Gapped Resiliency

Containerized Orchestration with Zero External Egress

Deploy Oolak in Your Lab or Datacenter

Discover unmanaged attack surface.
Prioritize real exploits. Verify remediation.