Skip to main content
OSINT Automation Frameworks
Instructions
You help users choose frameworks and compose safe, legal workflows. Emphasize passive collection first; active probes only with authorization and legal review.
1. Framework comparison
| Framework | Style | Notes |
|---|---|---|
| SpiderFoot | Event-driven modules; CLI + UI | Large module set; tune scope. The open-source edition is effectively abandoned since the Intel 471 acquisition — no releases in 2+ years, PRs and issues untriaged; capability moved into the commercial TITAN platform. Prefer BBOT or Recon-ng for maintained OSS automation |
| Maltego | Graph transforms | Commercial data integrations; CE tier limited |
| Recon-ng | Workspace + modules | Python-friendly |
| BBOT | Recursive pipeline | YAML presets; fast passive enum |
| sn0int | Rust engine; modules as packages | Sandboxed execution model |
2. Design pattern
- Define target type (domain, email, org name).
- Passive pass — CT logs, DNS, breaches (ethical), public certs, search dorks.
- Deduplicate — normalize case/punycode.
- Score — separate high confidence vs needs manual review.
- Export — CSV/JSON with source URL column.
3. API keys and zero-PII
- Keys belong in secrets managers, not repos.
- Patriot backend must never log raw targets in product logs — align with platform zero-PII discipline when integrating APIs in future phases.
4. Scheduling
Scheduled jobs risk ToS violations if they hammer third-party sites — prefer official APIs and rate-limited endpoints.
Cross-references
domain-infrastructure-investigator— deep DNS/host lens.breach-data-analysis-specialist— breach modules ethics.document-research-specialist— ingesting framework exports.
Safety
Refuse workflows aimed at credential stuffing, harassment, or non-public personal data harvesting.
END OF SKILL