STAR-RESEARCH-001 OSINT Feature Landscape

Open-source intelligence, or OSINT: Information collected and analyzed from sources that are openly available to the public or otherwise lawfully accessible to the operator.

StarIntel: The local-first intelligence platform being designed in this repository to collect, normalize, connect, search, analyze, and export structured documents through actor-based components.

Document model: The rules defining the fields, types, relationships, lifecycle, and interpretation of records stored by a system.

Actor runtime: Software that runs many independent actors, delivers messages to them, schedules their work, and manages their lifecycle.

Domain gserver: A managed tree of actors responsible for one intelligence area, such as cyber, social-media intelligence, or human intelligence.

Local-first: Designed to work primarily on equipment controlled by the operator, while still permitting optional remote or hosted components.

SpiderFoot: An open-source OSINT automation tool whose modules exchange discovered event types and perform collection, enrichment, analysis, and correlation.

IntelOwl: An open-source threat-intelligence analysis platform built from modular analyzers, connectors, pivots, visualizers, ingestors, and playbooks.

OpenCTI: An open-source cyber-threat-intelligence platform centered on a knowledge graph, connectors, cases, analysis, and integrations.

MISP: An open-source platform for storing, correlating, analyzing, and sharing threat intelligence and structured indicators.

Maltego: An investigation platform that represents information as graph entities and expands them through transforms and reusable machines.

Aleph and FollowTheMoney: Open-source investigative data tools developed around document search, bulk ingestion, and a shared schema for people, organizations, assets, and relationships.

Actor manifest: A declarative document describing an actor's identity, capabilities, dependencies, configuration, and lifecycle requirements.

Dataset manifest: A declarative document describing a dataset, its storage, processing flow, indexing, actor bindings, and lifecycle.

Dispatcher: A pool of worker threads that runs actor mailbox work. StarIntel partitions dispatchers primarily by domain and may create subdomain dispatchers inside the same process.

Supervision: A runtime mechanism in which a parent component watches child components and applies declared restart, stop, or escalation rules when they fail.

ZeroMQ: A messaging library that provides socket patterns for transferring messages between threads, processes, or machines without requiring a central broker.

Star Router: The StarIntel component responsible for client-facing and cross-process routing rather than ordinary in-process actor mailbox delivery.

Provenance: Structured information recording where data came from, how it was collected or produced, and which processing steps changed it.

Replay: Re-running recorded inputs and processing decisions to reproduce or rebuild prior results.

Publisher/subscriber model: A message pattern where producers publish events by type and interested consumers subscribe to those types without the producer naming every consumer.

YAML: A human-readable text format commonly used for configuration files and declarative rules.

SpiderFoot official repository and feature documentation: https://github.com/smicallef/spiderfoot

Capability catalog: A searchable inventory of operations the system can perform, including their accepted inputs, produced outputs, requirements, costs, policies, and runtime placement.

Artifact: A stable file or observable, such as a domain name, address, document, or hash, that may be processed by several analysis operations.

IntelOwl official repository and feature documentation: https://github.com/intelowlproject/IntelOwl

Playbook: A versioned, repeatable description of analysis steps and how data moves between them.

Pivot: Starting a new analysis from a result discovered during an earlier analysis, such as looking up an address found inside a document.

Annotation: A note, assessment, opinion, or decision attached by an analyst to another document without overwriting the original document.

Knowledge graph: A collection of typed entities and explicit relationships that can be navigated and queried as a connected graph.

OpenCTI official connector documentation: https://docs.opencti.io/latest/deployment/connectors/

OpenCTI official platform overview: https://docs.opencti.io/latest/usage/overview/

OpenCTI official Integration Manager documentation: https://docs.opencti.io/latest/deployment/integration-manager/

Checkpoint: Saved progress showing how far an importer or workflow has processed, allowing it to continue later without starting over.

Connector instance: One configured running copy of a reusable connector capability, bound to particular credentials, source scope, limits, checkpoint, and schedule.

Taxonomy: A controlled classification vocabulary used to label information consistently.

Warning list: A maintained set of common, misleading, benign, or otherwise special values that should trigger caution during analysis.

MISP official features documentation: https://www.misp-project.org/features/

MISP official taxonomy repository: https://github.com/MISP/misp-taxonomies

Transform: One typed operation that accepts an entity or document and returns related or enriched entities or documents.

Machine: A reusable workflow that composes multiple transforms in a declared sequence or parallel arrangement.

Maltego official Machines documentation: https://docs.maltego.com/en/support/solutions/articles/15000047415-introduction-to-maltego-machines

Maltego official Cases documentation: https://docs.maltego.com/en/support/solutions/articles/15000060312-what-is-maltego-cases-

Maltego official Local Transforms documentation: https://docs.maltego.com/en/support/solutions/articles/15000034021-local-transforms

Declarative: Describing the desired structure, rules, or result without embedding the step-by-step implementation code that performs it.

Aleph project organization and official repositories: https://github.com/alephdata

Side effect: An externally observable action beyond returning a value, such as making a network request, writing a file, changing a database, or launching a tool.

Analysis job: A durable record of one requested execution, including its inputs, chosen capabilities, state, intermediate results, failures, costs, and final outputs.

Case document: A record representing one investigation workspace and linking its targets, jobs, sources, findings, notes, views, and exports.

State machine: A model that defines the allowed states of a process and which events may move it from one state to another.

Common Lisp: A standardized programmable language in the Lisp family and the primary implementation language planned for the StarIntel server.

Application programming interface, or API: A defined set of operations and data formats that software components use to communicate.