performing-ai-driven-osint-correlation

name	performing-ai-driven-osint-correlation
description	Use AI and LLM-based reasoning to correlate findings across multiple OSINT sources—username enumeration, email lookups, social media profiles, domain records, breach databases, and dark-web mentions—into unified intelligence profiles with confidence scoring and link analysis. Use when working with performing ai driven osint correlation.
domain	cybersecurity
tags	["osint","ai-correlation","threat-intelligence","reconnaissance","link-analysis","target-profiling","sherlock","theharvester","spiderfoot","maltego"]
subdomain	threat-intelligence
version	1.0
author	oyi77
license	Apache-2.0
atlas_techniques	["AML.T0051","AML.T0054","AML.T0056"]
nist_ai_rmf	["MEASURE-2.7","MEASURE-2.5","GOVERN-6.1","MAP-5.1"]
d3fend_techniques	["Identifier Analysis","URL Analysis","Identifier Reputation Analysis","User Behavior Analysis","Content Validation"]
nist_csf	["ID.RA-01","ID.RA-05","DE.CM-01","DE.AE-02"]

Performing Ai Driven Osint Correlation

Overview

Cybersecurity skill for performing ai driven osint correlation. Follows industry best practices and security standards.

When to Use

Trigger phrases:

• "performing ai driven osint correlation"

• "Use AI and LLM-based reasoning to correlate findings across multiple OSINT sourc"

• You have collected raw OSINT data from multiple tools and sources but need to identify connections, contradictions, and patterns across them.

• You need to build a unified intelligence profile for a target entity (person, organization, or infrastructure) from fragmented data.

• Traditional manual correlation is too slow or error-prone for the volume of data collected.

• You want confidence-scored assessments of identity linkage across platforms rather than simple keyword matching.

When NOT to Use

• When you lack proper authorization for testing
• For production systems without change management
• When the task requires legal or compliance expertise beyond technical scope

Prerequisites

• Python 3.10+ with requests, json, and csv libraries
• Sherlock installed (pip install sherlock-project)
• theHarvester installed (pip install theHarvester)
• SpiderFoot 4.0+ running on localhost:5001
• Access to an LLM API (OpenAI, Anthropic, or local model via Ollama)
• Optional: Maltego CE for graph visualization of correlation results
• Optional: API keys for Shodan, VirusTotal, HaveIBeenPwned, Hunter.io

Workflow

# Example: IOC detection
import re

IOC_PATTERNS = {
    "ip": r"\b(?:\d{1,3}\.){3}\d{1,3}\b",
    "domain": r"\b[a-z0-9-]+\.[a-z]{2,}\b",
    "hash_md5": r"\b[a-f0-9]{32}\b",
    "hash_sha256": r"\b[a-f0-9]{64}\b",
}

 () -> :
     {k: re.findall(v, text)  k, v  IOC_PATTERNS.items()}