Open Source Intelligence Techniques for Defensible Collection

Technique in open source intelligence is usually taught as a catalog of lookups. In practice the lookups are the easy part and they are largely automated. What distinguishes work that holds up from work that does not is a small set of habits applied every time, to every finding, including the boring ones.

Technique one: pivot on the identifier, not the entity

A pivot is moving from one record to another through a shared value. The discipline is to pivot on things that are stable and machine-comparable rather than on things that merely look related.

• Strong pivots: a certificate serial or subject alternative name, an autonomous system number, a nameserver set, a registrant organization string that survived redaction, a company registration number, a favicon hash.
• Weak pivots: a shared cloud IP address, a common CDN, a similar page template, a matching stock photo. These generate false relationships at scale because thousands of unrelated tenants share the same infrastructure.

A useful rule: before you record a relationship, state how many other entities share that identifier. If the answer is "millions of Cloudflare customers," you do not have a relationship, you have a coincidence. If the answer is "the certificate names both hostnames explicitly," you have something worth writing down.

Technique two: corroborate across record systems, not across mirrors

Two sources that both derive from the same upstream registry are one source wearing two hats. Aggregators copy each other, and a fact that appears on six OSINT sites frequently traces back to one original record that was wrong.

Genuine corroboration means the second source is structurally independent. A registration date from RDAP corroborated by a certificate transparency entry predating it is real corroboration, because the two systems have nothing to do with each other. A registration date from three WHOIS front ends that all query the same registry is a single source.

Technique three: record the negative finding

The absence of a record is a finding, and it is frequently the most valuable one in the case. No DMARC record. No CAA record. No transfer lock. No filed accounts. These are the observations that describe posture, and analysts routinely fail to write them down because nothing came back.

Technique four: derive, do not dump

Raw records are not findings. A finding is what a record means for the decision in front of somebody. The derivation is the work, and it is the part a report has to show.

Every row of that table is a real derivation the DNS module and the registration module perform automatically, and the point of showing the middle column is that a reviewer can disagree with it. A dump gives a reviewer nothing to disagree with, which sounds safer and is actually much weaker.

Technique five: retrieval discipline, without exceptions

Every finding carries three attachments: the raw record as returned, the endpoint it came from, and the UTC moment of retrieval. Not most findings. Every one, including the ones you are certain about, because the ones you are certain about are the ones that get challenged.

Use UTC. An investigation that crosses two time zones and records local times will eventually produce a sequence of events that is wrong, and reconstructing it a year later is miserable. Use the full ISO 8601 form with the Z suffix, and let the report render it in local time if a reader wants that.

Technique six: write the scope before you collect

The declaration is a technique, not paperwork. Written before collection it constrains the work: a scope that says "vendor due diligence on this company's public infrastructure" tells you plainly that the director's personal social accounts are out of bounds, and you will feel the boundary when you approach it.

Written afterwards it is a justification, and it reads like one to anybody reviewing the file. The ordering is the entire point. Our how it works page shows where the declaration sits in a case, and the FAQ covers how legality actually turns on source, purpose, jurisdiction and basis rather than on the tool.

Technique seven: state your confidence

Analytic confidence is not decoration. "The mail provider is Google Workspace" is high confidence from an MX record. "This host belongs to the target organization" is medium confidence from a cloud IP address and high confidence from a certificate that names it. Say which, in the finding, in plain words.

Analysts who mark confidence get trusted with harder questions, because a reader can tell the difference between what you know and what you suspect. Analysts who assert everything at the same volume get checked line by line, forever.