REFERENCE

Glossary

The working vocabulary of open-source intelligence — 54 terms from foundations and SOCMINT to GEOINT, infrastructure, law, and tradecraft. Cross-references walk you from a term to the concept beside it.

Foundations

Attribution: The judgement that a specific person or group is responsible for an action or account. Requires multiple, independent, high-quality links — never a single data point. See: confidence
Confidence: A stated level of certainty (high / medium / low) attached to a finding, kept separate from the finding itself. Recording confidence prevents a guess from hardening into fact as it moves through a case. See: attribution
Confirmation bias: The tendency to seek and weight evidence that supports a hypothesis you already hold. Actively hunt for the disconfirming data.
Corroboration: Confirming a finding with at least one independent source that does not trace back to the original claim. Two copies of the same rumor are not corroboration. See: verification
Intelligence cycle: The repeatable loop that keeps an investigation honest: direction (what do we need?), collection, processing, analysis, dissemination, and feedback. Skipping direction is the most common reason a case stalls. See: osint
IOC(Indicator of Compromise): An observable artifact — a domain, IP, file hash, or email address — that suggests a system or account has been involved in an incident. Individually weak; powerful in clusters.
OSINT(Open-Source Intelligence): Intelligence produced from publicly available information — websites, social media, records, media, and data — that is collected, validated, and analyzed for a specific question. The source is open; the method and the analysis are what make it intelligence. See: intelligence cycle
PAI(Publicly Available Information): The raw material of OSINT: any information lawfully accessible to the public. PAI becomes intelligence only once it is collected against a requirement and corroborated.
Primary source: Original material created at the time — a raw photo, an official record, a post. Prefer primary sources; secondary sources interpret and can distort.
TTP(Tactics, Techniques & Procedures): The behavioural patterns of an actor, as opposed to their one-off tools. Mapping an adversary to TTPs is more durable than tracking individual indicators.
Verification: Confirming that a piece of content is authentic, unaltered, and correctly situated in time and place. Verification is a process, never a single check. See: corroboration

SOCMINT & identity

Alias: An alternative name, nickname, or handle a subject uses. Collecting aliases broadens every subsequent search.
Digital footprint: The accumulated trace a person leaves online — accounts, comments, photos, registrations — often far larger than the subject realizes.
Doxxing: Publishing a person’s private identifying information without consent, usually to harm. A privacy violation regardless of how the data was gathered. See: pii
Enumeration: Systematically checking a candidate identifier (usually a username) across many platforms to find where it is registered. Automate the checking, verify the matches by hand. See: handle
Gravatar: A globally recognized avatar keyed to an email hash. A quick way to test whether an email address has ever been registered on the web.
Handle: A username or @-name. Consistent handles across platforms are one of the strongest pivots in a person-focused investigation. See: enumeration
Pivot: Moving from one confirmed data point to a new lead: a handle to an email, an email to a photo, a photo to a place. Investigation is a chain of pivots, each logged.
Sock puppet(Sock puppet account): A fake identity used to interact with a target. From a defensive standpoint, a sign that a profile may not be a real person.
SOCMINT(Social Media Intelligence): OSINT drawn specifically from social platforms: posts, profiles, connections, and metadata. Rich in social context, and rich in noise. See: osint

GEOINT & imagery

Chronolocation: Determining when a photo or video was taken, from shadows, weather, events, foliage, or metadata — the time half of verification. See: geolocation
Deepfake: Synthetic or manipulated audio/video generated to depict someone saying or doing something they did not. Verify the source, not just the pixels.
Error level analysis(ELA): A heuristic that re-compresses an image and highlights regions with different compression histories — a hint of editing, never proof.
EXIF(Exchangeable Image File Format): The metadata block inside a photo that can hold camera model, timestamp, orientation, and GPS. Source of both great leads and great embarrassment if leaked from your own files. See: metadata
GEOINT(Geospatial Intelligence): Intelligence derived from imagery and geospatial data — locating and dating where a photo, video, or event actually took place. See: geolocation
Geolocation: Determining the place a piece of media or event shows, using visible clues (signage, architecture, terrain, shadows) rather than a reported location. See: chronolocation
Geotag: Embedded location data (usually GPS coordinates) stored in a file’s metadata. Often stripped by platforms — do not assume it is there, and do not assume it is not. See: exif
Perceptual hash: A fingerprint of an image’s visual content that survives resizing and minor edits. Used to match the “same” picture across platforms even when bytes differ. See: reverse image search
Reverse image search: Searching with an image instead of words to find other appearances of it. The core move for spotting recycled, misattributed, or earlier copies of a photo. See: perceptual hash
Shadow analysis: Using the direction and length of shadows, combined with sun-position tools, to estimate the time (and sometimes latitude) a photo was taken. See: chronolocation

Network & infrastructure

ASN(Autonomous System Number): An identifier for a network block owned by an organization or ISP. Grouping IPs by ASN reveals who really hosts a service.
Certificate transparency: Public logs of every TLS certificate issued. Searching them surfaces subdomains and services that were never meant to be advertised. See: subdomain
CIDR(Classless Inter-Domain Routing): Notation for an IP range, e.g. 203.0.113.0/24. Useful for scoping scans and understanding network ownership.
DNS(Domain Name System): The system that maps domain names to IP addresses. Records of interest include A, AAAA, MX, TXT, and CNAME. See: whois
Port scan: Probing a host for open ports to infer running services. Only ever run against systems you are authorized to test.
Reverse DNS: Looking up the hostname associated with an IP address — often reveals hosting provider and naming conventions.
Shodan: A search engine for internet-connected devices, indexing banners from open services. A discovery tool, not an exploitation tool.
Subdomain: A named host under a domain (e.g. mail.example.com). Subdomain enumeration often exposes staging sites, admin panels, and forgotten services.
Traceroute: A tool that maps the network path to a host, revealing intermediate routers and rough geography.
WHOIS: A public registry lookup for a domain or IP: registrar, creation date, and often registrant details (frequently privacy-shielded). See: dns

Law, ethics & data

Authorization: Documented permission to investigate a target or system — from the client, the employer, or in the case of systems, the owner. Without it, “research” is abuse.
Data breach: An incident in which personal data was exposed. Breach corpora are a common pivot for confirmed email/credential exposure (check only what you are authorized to). See: pii
Data minimization: The principle of collecting and retaining only the personal data necessary for the stated purpose. Reduces both legal risk and breach impact. See: pii
GDPR(General Data Protection Regulation): EU law governing the processing of personal data. It can apply to an investigator anywhere if the subject is in the EU — know your lawful basis.
Need-to-know: The practice of sharing findings only with those whose role requires them. Protects subjects, sources, and the integrity of the case.
PII(Personally Identifiable Information): Data that can identify a specific person — name, address, email, phone, government IDs. Handle the minimum needed, and store it securely or not at all. See: doxxing

Tradecraft & OPSEC

Attribution (of self): The risk that your own activity links back to you — shared accounts, reused avatars, timing, or payment. Assume any logged-in view is attributable.
Burner: A throwaway asset — number, email, or account — used once for a specific task and then abandoned, so it cannot be linked across tasks.
Canary: A unique, planted string (a token sprinkled into a document or account) that alerts you if the material surfaces somewhere it should not.
Fingerprinting: Platforms identifying you by browser, fonts, canvas, or device signals — even without cookies. A hardening concern for attributable research.
Metadata hygiene: Stripping author, GPS, and device data from files before you publish them — the reverse of the EXIF you exploit in others’ files. See: exif
OPSEC(Operational Security): Managing what you reveal while you work so targets and platforms cannot identify or profile you. A discipline, not a single tool. See: attribution
Sandbox: An isolated environment for opening untrusted files or links so malware cannot reach your real system.
Sock-puppet hygiene: Keeping research personas fully separated: distinct browser profiles, emails, and networks, with no crossover to your real identity.

Want the one-page version?Printable cheat sheet →