OSINT

The OSINT (Open Source Intelligence) profile contains one or more indicators and associated analysis and details, such as registrar (WHOIS) information and commentary about a hostname, or information about a digital certificate and its usage within a campaign. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers within the profile itself.

Attributes

osint

• Type: osint
• Requirement: required

The OSINT (Open Source Intelligence) object contains details related to an indicator such as the indicator itself, related indicators, geolocation, registrar information, subdomains, analyst commentary, and other contextual information. This information can be used to further enrich a detection or finding by providing decisioning support to other analysts and engineers.

Available In

• account_change
• admin_group_query
• airborne_broadcast_activity
• api_activity
• application_error
• application_lifecycle
• application_security_posture_finding
• authentication
• authorize_session
• base_event
• cloud_resources_inventory_info
• compliance_finding
• config_state
• data_security_finding
• datastore_activity
• detection_finding
• device_config_state_change
• dhcp_activity
• dns_activity
• drone_flights_activity
• email_activity
• email_file_activity
• email_url_activity
• entity_management
• event_log_actvity
• evidence_info
• file_activity
• file_hosting
• file_query
• file_remediation_activity
• folder_query
• ftp_activity
• group_management
• http_activity
• iam_analysis_finding
• incident_finding
• inventory_info
• job_query
• kernel_activity
• kernel_extension_activity
• kernel_object_query
• memory_activity
• module_activity
• module_query
• network_activity
• network_connection_query
• network_file_activity
• network_remediation_activity
• networks_query
• ntp_activity
• osint_inventory_info
• patch_state
• peripheral_activity
• peripheral_device_query
• process_activity
• process_query
• process_remediation_activity
• rdp_activity
• remediation_activity
• scan_activity
• scheduled_job_activity
• script_activity
• security_finding
• service_query
• session_query
• smb_activity
• software_info
• ssh_activity
• startup_item_query
• tunnel_activity
• user_access
• user_inventory
• user_query
• vulnerability_finding
• web_resource_access_activity
• web_resources_activity
• win/prefetch_query
• win/registry_key_activity
• win/registry_key_query
• win/registry_value_activity
• win/registry_value_query
• win/windows_resource_activity
• win/windows_service_activity