Learn
LoginRegister
← All playbooks

Professional workflow · OSINT

OSINT investigation

Objective

Answer an investigative question with passive, policy-compliant collection, correlation, and a clear report.

Authorized scope

Public sources only unless broader legal authority exists. No social engineering, no account takeovers, no scraping that violates ToS/policy.

Prerequisites

  • OSINT ethics module
  • Written authorization / policy basis
  • Note-taking template
Course →Roadmap L1 →

Step-by-step workflow

  1. Step 01

    Question & constraints

    • Write the investigative question
    • List allowed sources and retention rules
    • Define stop conditions

  2. Step 02

    Passive collection

    • DNS / cert / archive / breach notifications as allowed
    • Capture source URL + timestamp for every claim

  3. Step 03

    Correlate

    • Cross-check identities and infrastructure pivots
    • Rate confidence per finding

  4. Step 04

    Report

    • Answer the question directly
    • Separate facts vs inferences
    • Recommend defensive actions

Expected evidence

  • Source log (URL, time, method)
  • Screenshots / exports with hashes if retained
  • Confidence-rated findings

Checklist

  • Authorization recorded
  • No active intrusion techniques
  • PII minimized in notes
  • Every claim sourced

Reporting template

Question: […]
Authority / policy: […]
Findings (fact): […]
Inferences: […]
Confidence: High/Med/Low
Recommendations: […]
Sources: […]

Remediation

  • Reduce org OSINT footprint (dorks, exposed docs)
  • Monitor domains and executive impersonation
  • Tighten public asset inventory

Related tools