Open Source Intelligence (OSINT)

Curriculum

About this path

Open source investigations rarely fail because there is nothing to find. They fail because the question was vague, the search became noisy, the same claim was repeated by several sources that were not actually independent, or the investigator became visible along the way. This path starts with method before tools. You turn a request into an answerable question, define the scope, decide where the evidence should exist, and set a stopping condition before opening a browser.

The second section is about working safely. You build a separate research workstation, learn what your traffic and browser expose, and create a research persona that can be maintained without linking the work back to your real identity. The goal is not anonymity as a slogan. It is reducing avoidable linkage while keeping the investigation reproducible and the case notes usable.

The third section is collection on the open web. You move from search operators and identifier enumeration into domain, DNS and certificate research, archived material, reverse image search, phone number research, and public records. The emphasis stays on pivots: what one fact lets you test next, what would count as a stronger link, and when a check would cross the line from observation into interaction.

The final section is verification and reporting. You test whether sources are truly independent, catch recycled or manipulated material, preserve evidence before it changes, and write a finding around what the evidence supports, what remains unknown, and what the reader should do next. Five investigations run across the path so the method is practised as a chain rather than recalled as isolated facts.

This is the beginner OSINT path. It does not require prior investigation experience or paid tooling. Advanced infrastructure mapping, passive DNS, internet-wide scanning, large-scale collection, APIs and dataset work belong to Advanced OSINT Investigations.

What you will learn

• Plan a collection before you open a browser. Turn a question into a written plan with its sources named and a stopping condition, so a search ends in a finding rather than in more tabs.
• Grade what you find instead of just collecting it. Separate how reliable a source is from how credible one claim is, and record which of the two you are leaning on.
• Work without leaving a trail back to you. Harden a research workstation, separate your traffic, and know what your browser, your Tor session and your own uploads still give away.
• Build a persona you can keep and abandon cleanly. Create a research identity that stands up to a look, age it so it does not read as new, and recognise the point where it is spent.
• Get from one fact to the next across the open web. Search operators past the basics, usernames and email across platforms, a domain out to its certificates and archived history, then images, phone numbers and public registries.
• Verify a finding before it becomes a claim. Corroborate across independent sources, spot recycled and manipulated material, and say plainly when the evidence does not support the claim.
• Write it so somebody can act on it. Preserve the evidence before it disappears, structure the finding around what it establishes, and put the so-what where a reader will see it.

Who this path is for

• Cyber Threat Intelligence and OSINT analysts who need a repeatable method for turning public information into a finding that can support a decision.
• Fraud, digital risk and digital risk protection analysts who investigate people, companies, domains, accounts and public records across the open web.
• SOC and incident response analysts who already search public sources during investigations and want stronger collection planning, OPSEC, verification and evidence handling.
• Researchers, journalists, students and career changers who need findings that can survive challenge and want to practise on public material without special access.

Guides for this path

• OSINT: The Complete GuideOpen Source Intelligence (OSINT) is the practice of collecting, analyzing, and acting on information gathered from publicly available sources. In a world where digital footprints expand with every click, OSINT has become one of the most powerful disciplines in cyber threat intelligence, law enforcement, journalism, and corporate security. Whether you are investigating a phishing campaign, verifying a source, or mapping an organization's attack surface, OSINT provides the foundation for evidence-

Frequently asked questions