ZeroTrace OSINT
Cases & dossiers
The full case workflow — filing findings, severity triage, auto-harvested identifiers, secret redaction — and the Markdown, JSON, and PDF dossier export formats, with what each contains.
Cases & dossiers
A long investigation produces a lot of results, and the useful ones scroll away fast. Cases are how ZeroTrace OSINT keeps them. A case is a working file for one investigation: as you run tools, you file the results that matter into it, and the workbench builds them into a dossier — a running index of every domain, IP, email, username, and other identifier the case has touched — that you can read, share, and hand off.
Building a case
- Create a case
Start a case for the investigation you're working on. It becomes the target of every "file to case" you make from here on.
- Add findings as you go
When a tool returns something worth keeping, send it into the case. It's filed as a finding — the tool that produced it, the input you gave, the full result value, any warnings, how long it took, and its sources — with its context intact, instead of disappearing up the results view.
- Triage as you go
Mark a finding's severity — info, low, medium, high, or critical — so the case reflects what actually matters as it grows, not just the order things were found in.
- Let it harvest identifiers
As findings come in, the workbench reads the identifiers out of them — domains, IPs, emails, usernames, URLs, hashes, phone numbers, ASNs, CIDRs, onion addresses, MAC addresses, CVEs, IBANs, VINs, and tracker IDs — and gathers them into their own columns in the dossier, so the connections between findings become visible without you transcribing anything by hand.
- Export the dossier
When you're ready, export the case as a finished dossier in the format that fits what comes next.
Auto-harvesting, and what it skips
You don't have to catalog a case by hand. When you file a result, OSINT classifies every value inside it and drops the pivotable ones into the matching dossier column. Two things it deliberately does not harvest: values that describe the answer rather than the subject (a reputation lookup's feed name or malware-family label looks like a domain but isn't your target), and secrets. Anything a finding contains that looks like a credential is redacted before it's stored, so a case never becomes a second place your own secrets end up sitting in plain text.
A finding the AI assistant writes into a case (rather than one you filed by hand from a tool result) also carries a grounding verdict — grounded, partial, unsupported, or not-checkable — recording how much of what it wrote was actually backed by tool output it ran. That verdict travels with the finding into the dossier, so a report never presents an assistant's inference with the same weight as a lookup a tool actually performed.
Export formats
A clean text report you can paste into notes, a ticket, or another document. Findings are laid out as readable sections with their fields summarized (large tables and deep structures are trimmed to a readable depth rather than dumped raw), each with its severity, source, and timing. Best when the report is headed into another document or a plain-text workflow.
What every format contains
Whatever the format, a dossier reflects the case behind it: every finding you chose to keep, with its input, its result, its severity, its sources, and when it was saved; and the identifiers the workbench harvested from those findings, gathered into the dossier's fields so the shape of the investigation — not just its raw output — comes through.
A case lives on your machine like the rest of your work. Nothing is uploaded — exporting a dossier is you choosing to write it out, not the app sending it anywhere. See Privacy.