Reporting

Normalized Reporting

OSINT Forge v0.8.0 turns preserved plugin and provider evidence into deterministic, provenance-linked findings, candidate observations, relationships, contradictions, and scoped confidence without treating automated leads as verified facts. Raw evidence remains unchanged and every normalized conclusion points back to its source.

Generate reports

osint case report example-case
osint case report example-case --format json
osint case report example-case --format html
osint case report example-case --format csv
osint case report example-case --format all

Format	Default file
Markdown	report.md
JSON	report.json
HTML	report.html
CSV	findings.csv

All report artifacts use owner-only permissions. Markdown and HTML link to preserved raw evidence. CSV contains one row per finding. JSON is the versioned master representation. Report schema 3 adds the provider intelligence graph to schema-2 candidate observations and includes case metadata, targets, outcomes, errors, findings, relationships, contradictions, confidence assessments, verification and temporal states, orphaned reviews, and traceability-integrity metadata while retaining earlier compatibility.

Findings and provenance

osint case findings example-case
osint case findings example-case --json

Each finding has a stable content-derived ID, kind, category, title, value, attributes, confidence, analyst note, target identity, plugin and framework versions, run ID, outcome, exit code, command, timestamps, exact source file, and raw-output directory.

Completed, failed, and dry-run-previewed jobs remain explicit outcomes. Failed and previewed jobs are not normalized. A completed job with missing, malformed, oversized, or unsafe structured output produces a visible normalization error and a nonzero command exit after available reports are written.

Intelligence graph

osint case intelligence example-case
osint case intelligence example-case --json

Provider observations are linked to preserved JSON evidence. Correlation retains every source, distinguishes mirrors and syndicated records from independent corroboration, exposes contradiction and rationale, and reports observation, relationship, identity, and currentness confidence separately from verification status. Tool absence or failure is disclosed and never treated as contradiction. Temporal status remains independent from identity support.

Analyst review

osint case annotate example-case FINDING_ID --confidence medium
osint case annotate example-case FINDING_ID --note "Needs corroboration."
osint case annotate example-case FINDING_ID --clear-note

Confidence values are unverified, low, medium, and high. New findings begin as unverified. Reviews are stored separately in findings/reviews.json and never modify raw evidence. If a finding later disappears, its review is retained as an orphaned review rather than silently discarded.

Confidence is an analyst assessment, not proof of identity or accuracy. Tool output remains an unverified lead until independently corroborated.

Shareable reports

osint case report example-case --format all --shareable

This writes shareable-report.md, shareable-report.json, shareable-report.html, and shareable-findings.csv. The conservative structure-only-v1 policy removes case purpose and authorization, original identifiers, target values, commands, raw and source paths, finding values and attributes, analyst notes, and error detail.

Plugin names, categories, finding kinds and titles, outcome states, exit codes, timestamps, and confidence remain. Redaction cannot recognize every contextual inference, so a human must inspect every artifact before distribution.

Candidate entities

Schema-2 plugin normalizers may emit deterministic candidate entities with exact target, plugin, run, and source-file provenance. osint case entities CASE canonicalizes and deduplicates seeds and candidates without erasing sources. Candidates remain leads: they do not establish a relationship or identity and are not recursively pursued in v0.5.

Contract boundary

Normalizers are deterministic, standard-library-only, network-free, and read-only. They project preserved output into a versioned finding contract; they do not rewrite raw evidence or independently establish identity.

The seed/candidate entity view, provider intelligence graph, normalized findings, and preserved evidence remain separate layers. Planning and evidence integrity shipped before v0.8; v0.8 ships relationship evidence, correlation, and explainable confidence inputs. Bounded recursive discovery remains committed for v0.9 through the Roadmap.

See Case Management, Plugin Development, and Security and Ethics.