# OSINT and Indicator Analysis

> Collect OSINT safely, analyse IPs, domains, DNS, URLs, hashes and certificates, pivot through infrastructure, and manage indicators in a TIP.

Canonical: https://codelivly.com/learning-paths/cti-osint-indicator-analysis
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Rooms | 5 |
| Lessons | 0 |

**OSINT and Indicator Analysis** is the second learning path of the Threat Intelligence Analyst career path. It builds directly on CTI Foundations and moves from concepts to hands-on analysis. The level is Beginner to Intermediate: the first three modules are Beginner, and the last two (pivoting, and threat intelligence platform workflows) are Intermediate.

You will learn to collect open source intelligence safely, lawfully and with recorded provenance; to read network and file indicators precisely; to pivot from a single indicator to related infrastructure while rating every link; and to manage indicators through normalisation, enrichment, scoring, expiry and disposition. Every module ends with a lab built on bundled synthetic data, so no live lookups or tools are needed.

**Measurable learning outcomes.** After completing this path you can:

- Classify collection activities as passive or active, apply OPSEC and legal constraints, rate sources with the Admiralty system and identify circular reporting.
- Record OSINT with complete provenance: locator, method, UTC timestamps, saved artefact hash and TLP 2.0 handling.
- Interpret IPv4/IPv6 prefixes, ASN and hosting context, and DNS records (A, AAAA, CNAME, MX, NS, TXT, PTR), stating what each can and cannot show.
- Parse and defang URLs, identify hash types, explain fuzzy hashing and imphash limits, and read X.509 certificate fields.
- Use RDAP, passive DNS and Certificate Transparency to pivot, rating each pivot as strong, moderate, weak or very weak, and stopping at the right point.
- Normalise, deduplicate, score and disposition indicators with a transparent model, applying allowlists and expiry.

**Prerequisites.** CTI Foundations, or equivalent knowledge of the intelligence lifecycle, requirements and basic source types.

## Rooms in this path

1. [OSINT Collection and Source Validation](https://codelivly.com/rooms/cti-osint-collection-and-source-validation) - Collect open source intelligence safely and lawfully, evaluate sources, and record provenance analysts can trust.
2. [IP Addresses, Domains, DNS, and Network Infrastructure](https://codelivly.com/rooms/cti-ip-domain-dns-infrastructure) - Read IP addresses, ASNs, hosting context, domain names and DNS records as an analyst, and know the limits of each.
3. [URLs, File Hashes, Certificates, and Digital Artifacts](https://codelivly.com/rooms/cti-urls-hashes-certificates-artifacts) - Parse and defang URLs, use cryptographic and fuzzy hashes correctly, read X.509 certificates, and rank artefacts by…
4. [WHOIS, Passive DNS, Certificate Transparency, and Infrastructure Pivoting](https://codelivly.com/rooms/cti-whois-pdns-ct-pivoting) - Use registration data, passive DNS and Certificate Transparency to pivot from one indicator to an operation, rating…
5. [Threat Intelligence Platforms and Enrichment Workflows](https://codelivly.com/rooms/cti-tip-enrichment-workflows) - Manage indicators in a threat intelligence platform: normalise, deduplicate, enrich, score, allowlist, expire and…

## Related

- [Career path: Threat Intelligence Analyst](https://codelivly.com/career-paths/threat-intelligence-analyst)
- [Security Monitoring and Compliance Automation](https://codelivly.com/learning-paths/security-monitoring-and-compliance-automation)
- [Software Supply Chain Security](https://codelivly.com/learning-paths/software-supply-chain-security)
- [Secrets Management and Pipeline Hardening](https://codelivly.com/learning-paths/secrets-management-and-pipeline-hardening)