otlite · Frameworks

Install IVRE on Linux or macOS in one command

IVRE stores and analyses scan results from Nmap, Masscan, Zeek, and passive DNS in a database, then lets you query and view them in a web UI. otlite installs the Python package; the scanners and database are separate.

IVRE in three lines

pipx install otlite
otlite install ivre
otlite run ivre -- --help

Runs ivre/ivre (GPL-3.0, ★ 4.2k, otlite 1.2.1, catalog updated Oct 23, 2026). otlite installs and runs it at a tested version; it does not change or verify the tool itself.

What IVRE is for

Keeping large scan datasets searchable.
Passive DNS and flow analysis from your own sensors.

Typed inputs for IVRE

IVRE has no typed input. Pass its own arguments after --; otlite info ivre shows an example.

Where the results go

Every run lands under ./results/ivre/<target>/ as a timestamped output file, a .meta.json sidecar (the exact command, start and end time, exit code, and the SHA-256 of the output), and a .envelope.json with the entities found, in the same shape for every tool. List runs with otlite results, group them with --case, compare the last two with otlite diff ivre <target>, and pull indicators out with otlite extract ivre.

Before you run it

Needs MongoDB or another supported database and the scanners themselves. Follow the project's setup before the first run.

Update, remove, inspect

otlite info ivre      # inputs, keys, an example command
otlite example ivre   # sample output, where there is one
otlite update ivre    # move to the next tested version
otlite remove ivre    # delete its virtualenv

Full reference: the otlite docs, and the tool's own README on GitHub.

Pairs with

BBOT

BBOT is a recursive scanner that starts from a domain or IP, discovers subdomains, hosts, and services, and feeds each finding back in as a new target.

secator

secator wraps dozens of recon and scanning tools behind one command with a shared output format, and runs them as tasks, workflows, or full scans.

Fierce

Fierce brute-forces subdomains with a wordlist, tries zone transfers, and scans the IP space around the hosts it finds for more names.

FAQ

IVRE with otlite, answered

How do I install IVRE on Kali, Ubuntu, or macOS?

Install otlite once with pipx install otlite (or the one-line installer on the otlite page), run otlite init, then otlite install ivre. The tool lands in its own virtualenv under ~/.otlite/, pinned to a version that was tested, so nothing touches your system Python. otlite doctor prints the command that fixes a missing git or venv module.

Which inputs does IVRE take through otlite?

IVRE does not take a typed input; pass its own arguments after --. otlite info ivre prints what it accepts and an example command.

Where does otlite save IVRE results?

Under ./results/ivre/<target>/ in the folder you run from, as a timestamped output file plus a .meta.json sidecar (the exact command, timing, exit code, and SHA-256) and a .envelope.json with the entities found. Add --case <name> to group runs, otlite results to list them, and otlite diff ivre <target> to compare the last two.

Does IVRE need an API key or a login?

No key is required for the basic run. Optional keys, where the project supports them, go in with otlite keys set NAME and are passed only to tools that declare them.

Can I run IVRE together with other tools?

Not through --all, because IVRE has no typed input. Run it on its own, or put it in a playbook with explicit arguments.