skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-ai-driven-osint-correlation

Correlate multi-source OSINT findings into confidence-scored intelligence profiles using LLM reasoning.

954|172|Updated Mar 13, 2026
Search Tags:#threat intelligence#osint#sherlock#correlation#entity resolution#link analysis#theharvester
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-ai-driven-osint-correlation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-ai-driven-osint-correlation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-intelligence/performing-ai-driven-osint-correlation
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-ai-driven-osint-correlation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires sherlock-project, theHarvester, openai.

What problem does it solve?

Raw OSINT data collected from tools like Sherlock, theHarvester, and SpiderFoot is fragmented across formats and sources, making manual correlation slow and error-prone. This Skill uses LLM-based reasoning to link identities, detect contradictions, and produce unified intelligence profiles with confidence scores.

Core Features & Use Cases

  • Multi-Source Collection: Runs Sherlock username enumeration, theHarvester email/host harvesting, SpiderFoot passive scans, and HaveIBeenPwned breach lookups into a single working directory.
  • AI-Driven Correlation: Normalizes findings into a common JSON schema, then sends them to an LLM (OpenAI, Anthropic, or Ollama) for entity resolution, link analysis, and confidence scoring.
  • Structured Reporting: Generates a JSON correlation report, a Markdown intelligence profile, and an optional Maltego-compatible CSV for graph visualization.
  • Use Case: During threat actor attribution, correlate a suspicious username from a phishing campaign with social profiles, domain registrations, and breach data to build a risk-scored attribution profile.

Quick Start

Ask the AI to correlate OSINT findings for a target domain by running Sherlock, theHarvester, and SpiderFoot, then produce a confidence-scored intelligence profile report.

Frequently Asked Questions about performing-ai-driven-osint-correlation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I correlate OSINT data from multiple sources?▼

Collect findings with Sherlock, theHarvester, and SpiderFoot, normalize them into a common JSON schema tagged by source and type, then send the normalized data to an LLM for cross-source entity correlation and confidence scoring.

What tools are used for OSINT username and email enumeration?▼

Sherlock enumerates usernames across 400+ social platforms, theHarvester harvests emails, subdomains, and hosts from public sources, and SpiderFoot automates collection across 200+ modules including infrastructure data.

Can I use a local LLM for OSINT correlation instead of OpenAI?▼

Yes, the correlation script supports any LLM API including Anthropic or a local model via Ollama. The example uses the OpenAI client with gpt-4o, but you can swap the client while keeping the same correlation prompt and JSON output format.

How do I avoid false positives when correlating usernames?▼

Filter common handles like admin, test, and info before correlation, since they inflate Sherlock matches into bogus profiles. Require independent verification from at least two sources before assigning confidence above 0.8, and manually spot-check 10-20% of linkages.

What are the limitations of AI-driven OSINT correlation?▼

LLMs may hallucinate linkages not supported by raw findings, and confidence scores are hypotheses weighted by evidence type rather than ground truth. Coverage is limited to monitored platforms, and stale breach data can persist after takedown, so timestamps must be verified.

Related Skills

Explore More Software Engineering Skills→
trilwutrilwu
109

performing-reconnaissance

Map external attack surface via OSINT, subdomain enumeration, and port scanning.

Community
Advanced
Liberty91LTDLiberty91LTD
15

initial-access-brokers

Consolidate and update initial access broker intelligence with actor profiles and cited sources.

Official
Advanced
AeonDaveAeonDave
15

maltego

Build entity relationship graphs for reconnaissance and threat intelligence.

Community
Intermediate
osocodeosocode

htmx

Build server-driven web UIs with HTMX attributes and progressive enhancement.

Community
Basic