# OSINT Collection and Source Validation

> Collect open source intelligence safely and lawfully, evaluate sources, and record provenance analysts can trust.

Canonical: https://codelivly.com/rooms/cti-osint-collection-and-source-validation
Last updated: 2026-10-28

| | |
|---|---|
| Level | Beginner |
| Category | Cybersecurity |
| Lessons | 5 |
| XP | 100 |

**Purpose.** Indicator analysis starts with collection. This module teaches you to collect OSINT passively and lawfully, protect your investigation and your organisation through good operational security, judge how far to trust each source, and record provenance so your work can be reproduced and shared correctly.

**Prerequisites.** CTI Foundations (the intelligence lifecycle, intelligence requirements and basic source types). No tools are needed beyond a browser.

**Learning outcomes.** After this module you can:

- Distinguish observables, indicators, IOCs and intelligence, and state the main limitations of each common indicator type.
- Classify collection activities as passive, semi-passive or active, and choose a safe and lawful approach for each.
- Rate sources with the Admiralty system and identify circular reporting by tracing citations to independent origins.
- Record a complete collection entry with UTC timestamps, a saved artefact hash and TLP 2.0 handling.

**Practical completion objective.** Review a synthetic collection log, identify independent origins, OPSEC and provenance failures, and submit a source evaluation matrix with a confidence-rated assessment.

## Lessons

1. Observables, Indicators and OSINT in CTI Work (15 min)
2. Safe, Lawful and Ethical OSINT Collection (15 min)
3. Evaluating OSINT Sources and Information (15 min)
4. Provenance, Collection Records and Timestamps (15 min)
5. Lab: Evaluate an OSINT Collection Log (45 min)

## Related

- [Learning path: OSINT and Indicator Analysis](https://codelivly.com/learning-paths/cti-osint-indicator-analysis)
- [All rooms](https://codelivly.com/rooms)