Reporting

Normalized Reporting

OSINT Forge v0.4.0 turns preserved tool output into deterministic, provenance-linked reports without treating automated leads as verified facts. Raw evidence remains unchanged and every normalized finding points back to its source.

Generate reports

osint case report example-case
osint case report example-case --format json
osint case report example-case --format html
osint case report example-case --format csv
osint case report example-case --format all

Format	Default file
Markdown	report.md
JSON	report.json
HTML	report.html
CSV	findings.csv

All report artifacts use owner-only permissions. Markdown and HTML link to preserved raw evidence. CSV contains one row per finding. JSON is the versioned master representation and includes case metadata, targets, outcomes, errors, findings, orphaned reviews, and integrity metadata.

Findings and provenance

osint case findings example-case
osint case findings example-case --json

Each finding has a stable content-derived ID, kind, category, title, value, attributes, confidence, analyst note, target identity, plugin and framework versions, run ID, outcome, exit code, command, timestamps, exact source file, and raw-output directory.

Completed, failed, and dry-run-previewed jobs remain explicit outcomes. Failed and previewed jobs are not normalized. A completed job with missing, malformed, oversized, or unsafe structured output produces a visible normalization error and a nonzero command exit after available reports are written.

Analyst review

osint case annotate example-case FINDING_ID --confidence medium
osint case annotate example-case FINDING_ID --note "Needs corroboration."
osint case annotate example-case FINDING_ID --clear-note

Confidence values are unverified, low, medium, and high. New findings begin as unverified. Reviews are stored separately in findings/reviews.json and never modify raw evidence. If a finding later disappears, its review is retained as an orphaned review rather than silently discarded.

Confidence is an analyst assessment, not proof of identity or accuracy. Tool output remains an unverified lead until independently corroborated.

Shareable reports

osint case report example-case --format all --shareable

This writes shareable-report.md, shareable-report.json, shareable-report.html, and shareable-findings.csv. The conservative structure-only-v1 policy removes case purpose and authorization, original identifiers, target values, commands, raw and source paths, finding values and attributes, analyst notes, and error detail.

Plugin names, categories, finding kinds and titles, outcome states, exit codes, timestamps, and confidence remain. Redaction cannot recognize every contextual inference, so a human must inspect every artifact before distribution.

Contract boundary

Normalizers are deterministic, standard-library-only, network-free, and read-only. They project preserved output into a versioned finding contract; they do not rewrite raw evidence or independently establish identity.

The v0.4 seed-entity view and normalized findings remain separate foundations. Later releases add entity extraction, relationship evidence, correlation, explainable confidence inputs, and bounded recursive discovery through the committed Roadmap.

See Case Management, Plugin Development, and Security and Ethics.