Open-source intelligence
noun · also OSINT · MITRE ATT&CK TA0043
Information gathered from publicly available sources, such as websites, social media, DNS records and public registries, for investigation or attack planning.
Open-source intelligence (OSINT) is not about open-source software. It means intelligence built from information anyone can legally access: company websites, job postings, social media profiles, news, public code repositories, domain registration and DNS records, certificate transparency logs and data from past breaches that has become public.
Both sides use it. Attackers rely on OSINT during reconnaissance (MITRE ATT&CK tactic TA0043) to learn employee names and email formats, the technologies a company uses and which systems are exposed to the internet. Defenders use the same sources to see their organization the way an attacker would, to investigate suspicious domains and IP addresses, and to enrich alerts.
Example
A job posting for a "Senior Citrix Administrator" reveals which remote access product the company uses, and the employees' LinkedIn profiles reveal the email format. With certificate transparency logs, an attacker finds a forgotten test portal on a subdomain. A defender who runs the same searches first can close that portal and alert the help desk about likely phishing pretexts.
Why it matters for a SOC analyst
OSINT is part of everyday triage: looking up a domain's registration date, checking whether an IP belongs to a cloud provider or a known VPN, or finding whether a leaked credential appeared in a public breach. Stay passive and legal: query public sources, but do not interact with an attacker's infrastructure in ways that could alert them or break the law.
Related terms
- Threat intelligence
Information about threats and threat actors, collected and analyzed so that an organization can make better security decisions.
- Spear phishing
Phishing aimed at a specific person or small group, using details about them to make the message credible enough to bypass suspicion.
- Social engineering
Manipulating people, rather than systems, into giving up information, access or money by exploiting trust, urgency, authority or helpfulness.