The OSINT Workflow That Finally Made My Notes Useful

I had 3,124 notes, zero answers, and a search bar that felt like gaslighting me.

For two years my OSINT system was a digital hoarding problem with better fonts. Every username, every breach paste, every weird subdomain I found at 2am went into Obsidian. I had folders. I had tags. I had a graph view that looked like someone sneezed on a spiderweb.

Then a client asked a simple question: what did you find on this person last month?

I had everything and I could find nothing. That was the moment I understood my notes were not a system. They were a junk drawer I was pretending was an archive.

This is the workflow that fixed it. Not a new plugin. Not a new app. A different way of thinking about what a note is actually for.

Your Notes Are Not a Knowledge Base. They Are a Junk Drawer

Most OSINT advice tells you to capture everything. Save the tweet. Clip the article. Archive the domain. What it does not tell you is what to do on day 47 when you have 80 versions of the same person and you cannot remember which email was the pivot that cracked it open.

We collect like we are building a library, but we investigate like we are solving a puzzle. Libraries are for browsing. Puzzles need edges, corners, and a table you can clear off.

My old system failed for three reasons:

1. I saved sources, not decisions. A link to a tool output is useless without the question I asked to get it and the reason I thought it mattered.

2. I organized by source type, not by investigation. Having a folder called usernames or emails is like organizing your kitchen by color. Technically organized. Practically useless when you are cooking.

3. I never defined done. So notes never ended. They just grew.

Useful notes have a half life. If you cannot use a note to answer a question or make a next move within 60 seconds, it is storage, not intelligence.

The Workflow: Intake, Enrich, Brief

I call it IEB. It is ugly and it works. Every piece of information goes through three distinct stages and lives in only one place at a time. No limbo.

1. Intake: Brutal Minimalism

Intake is not research. Intake is triage. The rule is simple: if it takes more than 30 seconds to capture, you are doing it wrong.

My intake template is five lines. That is it.

Entity: who or what is this about
Source: where did I get it, exact URL or tool
Raw: the exact claim, copy pasted, no paraphrasing
Question: what question does this answer or create
Next: what does this make me want to check next

No summary. No tags. No clever connections yet. I do not even link it to other notes. Intake is a cold bucket. You dump it in and you move on.

This is where I broke my habit of elaborate capture. I used to spend 10 minutes making a pretty note about a single username. Now I spend 20 seconds. Speed matters because volume kills you if you let it.

The tooling that finally made intake frictionless for me was stealing the structure from the OSINT Investigator Pack. Not for the dork lists, though the Dork Bible in there is vicious, but for the Obsidian workflows that force you into that five line constraint. It has an intake template that literally will not let you add extra fields. That constraint saved me. You can find it here: https://numbpilled.gumroad.com/l/osint-investigator-pack

If your intake is slow, your whole system will be abandoned by week three. Make it stupid fast.

2. Enrich: Build the Pivot Map

This is where 90 percent of people quit and start making dashboards. Do not make a dashboard.

Enrichment happens once a day, 25 minutes max. I take everything in intake and ask one question: what does this connect to and can I prove it?

I have one note per investigation called pivot-map. It is not pretty. It is a list.

TARGET: john.doe.92
- email [e-mail] [source: breach 2021] -> username john.doe.92 on forum X [confirmed]
- username john.doe.92 -> GitHub john-doe-92 [avatar match, not confirmed]
- GitHub -> real name J. Doe via commit email [e-mail] [high confidence]
- [e-mail] -> LinkedIn / company site / phone via hunter

Every line is a pivot with a confidence rating. Low, medium, high, confirmed. If it is not a pivot, it does not go on the map. An interesting fact about someone is not intelligence until it moves you.

This is also where I stopped dorking like a tourist. I used to google site:linkedin.com "john doe". Now I run structured pivot queries. The difference between a random google dork and a pivot query is intent. One is looking. The other is testing a hypothesis.

The Investigator Pack again earns its keep here. The Pivots section is a decision tree, not a list. Email to username to breach to infra. It tells you what to try next when your current pivot fails, which is most of the time. That is what turned my notes from a collection into an actual tradecraft loop.

The second rule of enrichment: if you cannot verify it with a second independent source, you mark it as unconfirmed and you do not brief it. Ever. Your future self will thank you when you are not explaining to a client why you doxxed the wrong guy because of a reused avatar.

3. Brief: Write Like Someone Else Has to Use It

This is the part that finally made my notes useful. Every investigation ends with a brief note, even if the investigation is just for me.

A brief is not a summary. It is an answer.

My brief template:

Question Asked: What was the original ask
Answer: One paragraph, plain English
Evidence: 3 to 5 bullets, each with source and confidence
Gaps: What I still do not know
Next Actions: If I had two more hours, what would I do

The brief is the only note I am allowed to search later. Intake gets archived weekly. Pivot maps get collapsed into the brief. If it is not in the brief, it did not happen.

This feels painful at first. You will want to keep everything just in case. That just in case is the addiction talking. Intelligence is not about keeping everything. It is about being able to decide under uncertainty. A good brief forces a decision.

I write my briefs in a separate vault that has zero plugins. No graph view. No dataview. Just markdown. If your system requires six plugins to read your own conclusion, you built a toy, not a tool.

The Automation I Actually Use

I used to think automation meant writing 400 Python scripts I would never maintain. Now automation means one thing: reducing the clicks between a question and a pivot.

I run a local operator workstation that watches my intake folder. When I drop a domain, it auto pulls WHOIS, cert history, passive DNS, and screenshot, then appends it to the intake note as raw. When I drop an email, it runs holehe and checks breach sources. I do not touch it.

I did not build this from scratch because I am lazy and honest about it. I ripped the scaffolding from the OpenClaw Operator Workstation. It is marketed as an AI workstation, but what it actually is is a sane file structure for local agents with prewired OSINT recipes that do not phone home. I stripped out the parts I did not need and kept the file watchers and the prompt chains that turn raw tool output into that five line intake format automatically. Link here if you want to see the skeleton: https://numbpilled.gumroad.com/l/openclaw-operator-workstation

The point is not the tool. The point is the principle. If you do the same three lookups more than five times, automate the boring part so your brain can do the enrichment. Your job is not to be a human API wrapper for Hunter and Shodan.

If you live in the terminal, the companion piece is the Terminal Operator Pack. Same philosophy, different surface. Black Terminal plus the Bash Necromancer scripts gave me the one liners that turn a list of 200 subdomains into a pivot map in under a minute without opening a browser. It is not sexy. It is fast: https://numbpilled.gumroad.com/l/terminal-operator-pack-v2

Pick whichever surface you actually live in. Do not build both.

Opsec Is Not a Chapter. It Is the Watermark

Here is the edgy part nobody wants to hear. Most OSINT workflows are exhibitionist.

You are logged into your personal Chrome profile with 30 extensions, searching a target who has Cloudflare and a grudge, while your notes sync to a cloud service that keeps version history forever. You are not investigating. You are leaving a trail of breadcrumbs back to your house with your name on them.

I made opsec part of the workflow, not an afterthought.

Intake happens on a disposable VM or at least a hardened profile. No personal logins. No sync.

Enrichment happens offline first. I write pivots locally, then I go fetch. Not the other way around. Browsing is the noisy part.

Briefs are the only thing that ever leaves the machine. And they are stripped of queries and tool artifacts.

I used to treat privacy guides like paranoid cosplay until I started looking at my own metadata. Your Obsidian export contains creation times, your machine name, sometimes your location history if you clipped from mobile. Your screenshots have monitor resolution. Your PDFs have your username.

The Privacy Opsec Stack is the only bundle I have found that treats this as a workflow problem instead of a VPN sales pitch. Ghost Mode for browser isolation, Metadata for actually cleaning your artifacts, and the AI Native OSINT part for doing enrichment locally instead of pasting a target's life into ChatGPT. I run its Nukepack checklist every time I start a new investigation. Takes four minutes. Saves me from being the subject of someone else's pivot map: https://numbpilled.gumroad.com/l/privacy-opsec-stack

You do not need to be a spy to need opsec. You just need to have once looked up someone who knows how to look back.

If You Steal One Thing From This Post

Steal the brief.

If you do nothing else, start writing a 150 word answer at the end of every rabbit hole. Not tomorrow. Today.

Because useful notes are not about memory. They are about leverage. The value of an investigation is not how much you collected. It is how quickly you can turn what you collected into a decision someone can act on.

My vault is smaller now. About 400 notes instead of 3,000. I can find anything in under a minute. I close more investigations. I get fewer of those cold sweats when a client asks a follow up.

The system is not clever. That is why it survived.

Intake fast. Enrich with a map, not a mood board. Brief like a professional. Automate the chores. Watermark everything with opsec.

Do that for 30 days and your notes will stop being a place you hide information and start being a place that gives you answers.