{"metadata":{"id":"osint.dev/open-osint-knowledge-graph","title":"Open OSINT Knowledge Graph","version":"0.1.0","publishedAt":"2026-09-20","updatedAt":"2026-09-20","canonicalPath":"/osint/knowledge-graph","jsonPath":"/osint/knowledge-graph.json","csvPath":"/osint/knowledge-graph.csv","description":"A versioned semantic reference layer connecting OSINT source families, investigative tasks, techniques, tools, risks and intelligence outputs.","license":{"name":"Creative Commons Attribution 4.0 International","spdx":"CC-BY-4.0","url":"https://creativecommons.org/licenses/by/4.0/"},"citation":"OSINT.dev. Open OSINT Knowledge Graph v0.1.0. https://osint.dev/osint/knowledge-graph"},"nodes":[{"id":"source:web-archives","kind":"source","label":"Web & archives","description":"Websites, search indexes, cached pages and historical snapshots used as open-source evidence.","url":"/osint#osint-sources"},{"id":"source:public-records","kind":"source","label":"Public records","description":"Official registries, filings, court records, procurement data and public notices.","url":"/osint#osint-sources"},{"id":"source:news-publications","kind":"source","label":"News & publications","description":"Journalism, institutional reports, academic literature and specialist research.","url":"/osint#osint-sources"},{"id":"source:social-platforms","kind":"source","label":"Social platforms","description":"Publicly accessible posts, profiles, discussions and network signals.","url":"/osint#osint-sources"},{"id":"source:technical-infrastructure","kind":"source","label":"Technical infrastructure","description":"DNS, RDAP, certificates, IP/ASN data and other observable infrastructure metadata.","url":"/osint#osint-sources"},{"id":"source:geospatial-multimedia","kind":"source","label":"Geospatial & multimedia","description":"Maps, imagery, photographs, video, audio and associated metadata.","url":"/osint#osint-sources"},{"id":"source:commercial-information","kind":"source","label":"Commercially available information","description":"Datasets, databases and research services available through legitimate commercial access.","url":"/osint#osint-sources"},{"id":"source:code-artifacts","kind":"source","label":"Code & technical artifacts","description":"Public repositories, packages, commits, documentation and software-development traces.","url":"/osint#osint-sources"},{"id":"task:entity-resolution","kind":"task","label":"Entity resolution","description":"Determine whether records, identifiers and public traces refer to the same real-world entity.","url":"/osint#how-osint-works"},{"id":"task:domain-reconnaissance","kind":"task","label":"Domain reconnaissance","description":"Map registration, DNS, certificates and observable services associated with a domain.","url":"/osint#how-osint-works"},{"id":"task:infrastructure-attribution","kind":"task","label":"Infrastructure attribution","description":"Assess ownership, control and relationships across public network infrastructure.","url":"/osint#how-osint-works"},{"id":"task:media-verification","kind":"task","label":"Media verification","description":"Assess provenance, authenticity, context and reuse of images or other media.","url":"/osint#how-osint-works"},{"id":"task:claim-verification","kind":"task","label":"Claim verification","description":"Test a public claim against independent evidence, primary sources and chronology.","url":"/osint#how-osint-works"},{"id":"task:corporate-due-diligence","kind":"task","label":"Corporate due diligence","description":"Research companies, ownership, identifiers, counterparties and public risk signals.","url":"/osint#how-osint-works"},{"id":"task:timeline-reconstruction","kind":"task","label":"Timeline reconstruction","description":"Build and test a chronology from timestamped, archived and corroborated evidence.","url":"/osint#how-osint-works"},{"id":"task:geolocation","kind":"task","label":"Geolocation","description":"Assess where an event, asset or piece of media was created or observed.","url":"/osint#how-osint-works"},{"id":"technique:cross-source-corroboration","kind":"technique","label":"Cross-source corroboration","description":"Compare independent sources and note agreement, contradiction, provenance and confidence.","url":"/osint#collection-verification-analysis"},{"id":"technique:rdap-registration-analysis","kind":"technique","label":"RDAP registration analysis","description":"Inspect registration and ownership metadata exposed through RDAP.","url":"/osint#collection-verification-analysis"},{"id":"technique:dns-enumeration","kind":"technique","label":"DNS enumeration","description":"Resolve and compare public DNS records to identify infrastructure and configuration relationships.","url":"/osint#collection-verification-analysis"},{"id":"technique:certificate-transparency-pivoting","kind":"technique","label":"Certificate Transparency pivoting","description":"Use public certificate logs to identify hostnames and infrastructure relationships.","url":"/osint#collection-verification-analysis"},{"id":"technique:reverse-dns-pivoting","kind":"technique","label":"Reverse DNS pivoting","description":"Use PTR and related DNS evidence to connect public IP infrastructure with hostnames.","url":"/osint#collection-verification-analysis"},{"id":"technique:metadata-extraction","kind":"technique","label":"Metadata extraction","description":"Extract embedded metadata from files or media while preserving provenance and context.","url":"/osint#collection-verification-analysis"},{"id":"technique:reverse-image-search","kind":"technique","label":"Reverse image search","description":"Search for earlier or related visual appearances to test provenance and reuse.","url":"/osint#collection-verification-analysis"},{"id":"technique:archival-comparison","kind":"technique","label":"Archival comparison","description":"Compare current and historical versions of public web material.","url":"/osint#collection-verification-analysis"},{"id":"technique:geocoding","kind":"technique","label":"Geocoding & reverse geocoding","description":"Translate between place descriptions and coordinates as one input to geospatial verification.","url":"/osint#collection-verification-analysis"},{"id":"technique:entity-link-analysis","kind":"technique","label":"Entity link analysis","description":"Connect organizations, identifiers and public records into explicit, reviewable relationships.","url":"/osint#collection-verification-analysis"},{"id":"tool:rdap-domain-lookup","kind":"tool","label":"RDAP Domain Lookup","description":"OSINT.dev catalog tool for public domain registration data.","url":"/tools/rdap-domain-lookup"},{"id":"tool:dns-inspector","kind":"tool","label":"DNS / MX / SPF / DMARC Inspector","description":"OSINT.dev catalog tool for public DNS inspection.","url":"/tools/dns-inspector"},{"id":"tool:crtsh","kind":"tool","label":"crt.sh","description":"OSINT.dev catalog entry for Certificate Transparency search.","url":"/tools/crtsh"},{"id":"tool:reverse-dns-ptr","kind":"tool","label":"Reverse DNS / PTR Intelligence","description":"OSINT.dev catalog tool for PTR and reverse-DNS pivots.","url":"/tools/reverse-dns-ptr"},{"id":"tool:exiftool","kind":"tool","label":"ExifTool","description":"OSINT.dev catalog entry for metadata extraction and inspection.","url":"/tools/exiftool"},{"id":"tool:tineye","kind":"tool","label":"TinEye","description":"OSINT.dev catalog entry for reverse-image search.","url":"/tools/tineye"},{"id":"tool:wayback-machine","kind":"tool","label":"Wayback Machine","description":"OSINT.dev catalog entry for historical web snapshots.","url":"/tools/wayback-machine"},{"id":"tool:nominatim-geocoder","kind":"tool","label":"Nominatim Geocoder & Reverse Geocoder","description":"OSINT.dev catalog tool for geocoding and reverse geocoding.","url":"/tools/nominatim-geocoder"},{"id":"tool:opencorporates","kind":"tool","label":"OpenCorporates","description":"OSINT.dev catalog entry for company registry research.","url":"/tools/opencorporates"},{"id":"tool:gleif-lei-lookup","kind":"tool","label":"GLEIF LEI Lookup & Entity Resolver","description":"OSINT.dev catalog tool for LEI-based entity resolution.","url":"/tools/gleif-lei-lookup"},{"id":"tool:opensanctions","kind":"tool","label":"OpenSanctions","description":"OSINT.dev catalog entry for sanctions and entity screening data.","url":"/tools/opensanctions"},{"id":"tool:urlscan","kind":"tool","label":"urlscan.io","description":"OSINT.dev catalog entry for public URL and web-infrastructure observations.","url":"/tools/urlscan"},{"id":"risk:privacy","kind":"risk","label":"Privacy & data protection","description":"Public availability does not remove privacy, data-protection or jurisdictional obligations.","url":"/osint#ethics-privacy-legality"},{"id":"risk:terms-access-controls","kind":"risk","label":"Terms & access controls","description":"Technical reachability does not automatically authorize every collection method or downstream use.","url":"/osint#ethics-privacy-legality"},{"id":"risk:source-reliability","kind":"risk","label":"Source reliability","description":"Public information can be incomplete, manipulated, stale or contextually misleading.","url":"/osint#ethics-privacy-legality"},{"id":"risk:misidentification","kind":"risk","label":"Misidentification","description":"Weak entity resolution can merge different people, organizations or assets into one false identity.","url":"/osint#ethics-privacy-legality"},{"id":"risk:operational-exposure","kind":"risk","label":"Operational exposure","description":"Some collection methods can reveal investigator infrastructure, intent or target interest.","url":"/osint#ethics-privacy-legality"},{"id":"risk:sensitive-data","kind":"risk","label":"Sensitive information","description":"Personal or high-risk information requires additional safeguards in collection, storage and dissemination.","url":"/osint#ethics-privacy-legality"},{"id":"output:verified-entity","kind":"output","label":"Verified entity profile","description":"A source-backed assessment of an entity and the identifiers or records attributed to it.","url":"/osint#information-vs-intelligence"},{"id":"output:infrastructure-map","kind":"output","label":"Infrastructure map","description":"A reviewable map of domains, hostnames, addresses, ownership and technical relationships.","url":"/osint#information-vs-intelligence"},{"id":"output:verified-media","kind":"output","label":"Verified media assessment","description":"A finding describing provenance, context, reuse and confidence for a media item.","url":"/osint#information-vs-intelligence"},{"id":"output:timeline","kind":"output","label":"Reconstructed timeline","description":"A chronology with source provenance, gaps, conflicts and confidence notes.","url":"/osint#information-vs-intelligence"},{"id":"output:confidence-assessment","kind":"output","label":"Confidence assessment","description":"An explicit statement of what is known, inferred, uncertain and unsupported.","url":"/osint#information-vs-intelligence"},{"id":"output:source-backed-finding","kind":"output","label":"Source-backed finding","description":"A defensible finding tied to preserved evidence, context and stated limitations.","url":"/osint#information-vs-intelligence"}],"relations":[{"id":"rel:001","from":"source:web-archives","predicate":"supports","to":"task:timeline-reconstruction","description":"Historical snapshots support reconstruction of how public material changed over time."},{"id":"rel:002","from":"source:web-archives","predicate":"supports","to":"task:claim-verification","description":"Archived versions can confirm or contradict what was publicly available at a given time."},{"id":"rel:003","from":"source:public-records","predicate":"supports","to":"task:entity-resolution","description":"Official identifiers and filings support entity matching."},{"id":"rel:004","from":"source:public-records","predicate":"supports","to":"task:corporate-due-diligence","description":"Registries and filings are core inputs to corporate due diligence."},{"id":"rel:005","from":"source:news-publications","predicate":"supports","to":"task:claim-verification","description":"Independent reporting and institutional publications provide corroborating context."},{"id":"rel:006","from":"source:news-publications","predicate":"supports","to":"task:timeline-reconstruction","description":"Timestamped publications can provide dated milestones in a chronology."},{"id":"rel:007","from":"source:social-platforms","predicate":"supports","to":"task:media-verification","description":"Public posts can provide provenance and publication context for media."},{"id":"rel:008","from":"source:social-platforms","predicate":"supports","to":"task:timeline-reconstruction","description":"Public posts can provide timestamped observations subject to verification."},{"id":"rel:009","from":"source:technical-infrastructure","predicate":"supports","to":"task:domain-reconnaissance","description":"DNS, RDAP and certificate data are primary open inputs for domain reconnaissance."},{"id":"rel:010","from":"source:technical-infrastructure","predicate":"supports","to":"task:infrastructure-attribution","description":"Public technical metadata supports attribution hypotheses about infrastructure."},{"id":"rel:011","from":"source:geospatial-multimedia","predicate":"supports","to":"task:geolocation","description":"Imagery, maps and metadata provide inputs to geolocation."},{"id":"rel:012","from":"source:geospatial-multimedia","predicate":"supports","to":"task:media-verification","description":"Visual and metadata evidence support media verification."},{"id":"rel:013","from":"source:commercial-information","predicate":"supports","to":"task:corporate-due-diligence","description":"Legitimately available commercial datasets can enrich public-record research."},{"id":"rel:014","from":"source:code-artifacts","predicate":"supports","to":"task:entity-resolution","description":"Public code and commit history can connect handles, projects and organizations."},{"id":"rel:015","from":"task:entity-resolution","predicate":"uses","to":"technique:entity-link-analysis","description":"Entity resolution relies on explicit links between identifiers and records."},{"id":"rel:016","from":"task:entity-resolution","predicate":"uses","to":"technique:cross-source-corroboration","description":"Independent corroboration reduces false entity matches."},{"id":"rel:017","from":"task:domain-reconnaissance","predicate":"uses","to":"technique:rdap-registration-analysis","description":"Registration metadata is a core domain-reconnaissance input."},{"id":"rel:018","from":"task:domain-reconnaissance","predicate":"uses","to":"technique:dns-enumeration","description":"DNS enumeration exposes public infrastructure relationships."},{"id":"rel:019","from":"task:domain-reconnaissance","predicate":"uses","to":"technique:certificate-transparency-pivoting","description":"Certificate logs can reveal related hostnames."},{"id":"rel:020","from":"task:infrastructure-attribution","predicate":"uses","to":"technique:reverse-dns-pivoting","description":"Reverse DNS can connect IP infrastructure to hostnames."},{"id":"rel:021","from":"task:infrastructure-attribution","predicate":"uses","to":"technique:rdap-registration-analysis","description":"RDAP can provide ownership and registration context for network assets."},{"id":"rel:022","from":"task:media-verification","predicate":"uses","to":"technique:metadata-extraction","description":"Embedded metadata is one evidentiary input for media verification."},{"id":"rel:023","from":"task:media-verification","predicate":"uses","to":"technique:reverse-image-search","description":"Earlier visual appearances help test provenance and reuse."},{"id":"rel:024","from":"task:claim-verification","predicate":"uses","to":"technique:cross-source-corroboration","description":"Claims should be tested against independent sources."},{"id":"rel:025","from":"task:claim-verification","predicate":"uses","to":"technique:archival-comparison","description":"Archived evidence can test historical claims and changes."},{"id":"rel:026","from":"task:corporate-due-diligence","predicate":"uses","to":"technique:entity-link-analysis","description":"Due diligence connects companies, identifiers, owners and counterparties."},{"id":"rel:027","from":"task:timeline-reconstruction","predicate":"uses","to":"technique:archival-comparison","description":"Archived pages support dated event reconstruction."},{"id":"rel:028","from":"task:geolocation","predicate":"uses","to":"technique:geocoding","description":"Geocoding supports place normalization and coordinate checks."},{"id":"rel:029","from":"task:geolocation","predicate":"uses","to":"technique:metadata-extraction","description":"Location metadata can contribute to a broader geolocation assessment."},{"id":"rel:030","from":"technique:rdap-registration-analysis","predicate":"assisted_by","to":"tool:rdap-domain-lookup","description":"The catalog tool exposes RDAP registration data."},{"id":"rel:031","from":"technique:dns-enumeration","predicate":"assisted_by","to":"tool:dns-inspector","description":"The catalog tool resolves public DNS records."},{"id":"rel:032","from":"technique:certificate-transparency-pivoting","predicate":"assisted_by","to":"tool:crtsh","description":"crt.sh exposes public Certificate Transparency records."},{"id":"rel:033","from":"technique:reverse-dns-pivoting","predicate":"assisted_by","to":"tool:reverse-dns-ptr","description":"The catalog tool performs PTR and reverse-DNS lookups."},{"id":"rel:034","from":"technique:metadata-extraction","predicate":"assisted_by","to":"tool:exiftool","description":"ExifTool extracts embedded metadata from supported file types."},{"id":"rel:035","from":"technique:reverse-image-search","predicate":"assisted_by","to":"tool:tineye","description":"TinEye supports reverse-image search."},{"id":"rel:036","from":"technique:archival-comparison","predicate":"assisted_by","to":"tool:wayback-machine","description":"Wayback Machine provides historical web snapshots."},{"id":"rel:037","from":"technique:geocoding","predicate":"assisted_by","to":"tool:nominatim-geocoder","description":"The catalog tool performs geocoding and reverse geocoding."},{"id":"rel:038","from":"technique:entity-link-analysis","predicate":"assisted_by","to":"tool:opencorporates","description":"Company registry data supports corporate entity linkage."},{"id":"rel:039","from":"technique:entity-link-analysis","predicate":"assisted_by","to":"tool:gleif-lei-lookup","description":"LEI data supports legal-entity resolution."},{"id":"rel:040","from":"technique:entity-link-analysis","predicate":"assisted_by","to":"tool:opensanctions","description":"Sanctions and entity datasets can enrich due-diligence link analysis."},{"id":"rel:041","from":"technique:cross-source-corroboration","predicate":"mitigates","to":"risk:source-reliability","description":"Independent corroboration helps reduce reliance on a single weak source."},{"id":"rel:042","from":"technique:entity-link-analysis","predicate":"requires_control","to":"risk:misidentification","description":"Entity links need explicit provenance and disambiguation controls."},{"id":"rel:043","from":"technique:metadata-extraction","predicate":"requires_control","to":"risk:sensitive-data","description":"Embedded metadata can expose personal or sensitive information."},{"id":"rel:044","from":"technique:reverse-image-search","predicate":"requires_control","to":"risk:privacy","description":"Image matching can expose or amplify personal information."},{"id":"rel:045","from":"technique:geocoding","predicate":"requires_control","to":"risk:privacy","description":"Precise locations can create privacy and safety implications."},{"id":"rel:046","from":"tool:urlscan","predicate":"requires_control","to":"risk:operational-exposure","description":"Submitting targets to third-party services can expose investigative interest."},{"id":"rel:047","from":"tool:opensanctions","predicate":"requires_control","to":"risk:misidentification","description":"Name matches require disambiguation before being treated as findings."},{"id":"rel:048","from":"tool:opencorporates","predicate":"requires_control","to":"risk:misidentification","description":"Corporate name similarity must not be treated as identity proof."},{"id":"rel:049","from":"source:social-platforms","predicate":"requires_control","to":"risk:terms-access-controls","description":"Collection must respect applicable platform access rules and legal constraints."},{"id":"rel:050","from":"source:commercial-information","predicate":"requires_control","to":"risk:terms-access-controls","description":"Commercial access terms constrain collection and downstream use."},{"id":"rel:051","from":"task:entity-resolution","predicate":"produces","to":"output:verified-entity","description":"A successful entity-resolution task yields a source-backed entity assessment."},{"id":"rel:052","from":"task:domain-reconnaissance","predicate":"produces","to":"output:infrastructure-map","description":"Domain reconnaissance can produce a map of related technical assets."},{"id":"rel:053","from":"task:infrastructure-attribution","predicate":"produces","to":"output:infrastructure-map","description":"Attribution work adds ownership and relationship context to infrastructure maps."},{"id":"rel:054","from":"task:media-verification","predicate":"produces","to":"output:verified-media","description":"Media verification produces a provenance and confidence assessment."},{"id":"rel:055","from":"task:timeline-reconstruction","predicate":"produces","to":"output:timeline","description":"Timeline reconstruction yields a source-backed chronology."},{"id":"rel:056","from":"task:claim-verification","predicate":"produces","to":"output:source-backed-finding","description":"Claim verification should end in a finding tied to evidence and limitations."},{"id":"rel:057","from":"task:claim-verification","predicate":"produces","to":"output:confidence-assessment","description":"Claim verification should state confidence and unresolved gaps."},{"id":"rel:058","from":"task:corporate-due-diligence","predicate":"produces","to":"output:source-backed-finding","description":"Due diligence produces reviewable findings about entities and relationships."},{"id":"rel:059","from":"risk:source-reliability","predicate":"constrains","to":"output:confidence-assessment","description":"Source reliability directly limits confidence in an intelligence judgment."},{"id":"rel:060","from":"risk:misidentification","predicate":"constrains","to":"output:verified-entity","description":"Unresolved identity ambiguity must remain visible in the final entity assessment."},{"id":"rel:061","from":"risk:privacy","predicate":"constrains","to":"output:source-backed-finding","description":"Privacy obligations constrain what evidence should be retained or disseminated."},{"id":"rel:062","from":"risk:sensitive-data","predicate":"constrains","to":"output:source-backed-finding","description":"Sensitive information requires proportionate handling in the final product."}],"references":[{"organization":"Office of the Director of National Intelligence","title":"Intelligence Community Open Source Intelligence Strategy 2024–2026","url":"https://www.dni.gov/files/ODNI/documents/IC_OSINT_Strategy.pdf"},{"organization":"OHCHR & UC Berkeley Human Rights Center","title":"Berkeley Protocol on Digital Open Source Investigations","url":"https://searchlibrary.ohchr.org/record/30334"},{"organization":"CERT-AGID","title":"OSINT–CLOSINT","url":"https://cert-agid.gov.it/glossario/osint-closint/"},{"organization":"SANS Institute","title":"What is Open-Source Intelligence?","url":"https://www.sans.org/blog/what-is-open-source-intelligence"}]}