Skip to content

ZeroTrace OSINT

Cases & dossiers

The full case workflow — filing findings, severity triage, auto-harvested identifiers, secret redaction — and the Markdown, JSON, and PDF dossier export formats, with what each contains.

Cases & dossiers

A long investigation produces a lot of results, and the useful ones scroll away fast. Cases are how ZeroTrace OSINT keeps them. A case is a working file for one investigation: as you run tools, you file the results that matter into it, and the workbench builds them into a dossier — a running index of every domain, IP, email, username, and other identifier the case has touched — that you can read, share, and hand off.

Building a case

  1. Create a case

    Start a case for the investigation you're working on. It becomes the target of every "file to case" you make from here on.

  2. Add findings as you go

    When a tool returns something worth keeping, send it into the case. It's filed as a finding — the tool that produced it, the input you gave, the full result value, any warnings, how long it took, and its sources — with its context intact, instead of disappearing up the results view.

  3. Triage as you go

    Mark a finding's severity — info, low, medium, high, or critical — so the case reflects what actually matters as it grows, not just the order things were found in.

  4. Let it harvest identifiers

    As findings come in, the workbench reads the identifiers out of them — domains, IPs, emails, usernames, URLs, hashes, phone numbers, ASNs, CIDRs, onion addresses, MAC addresses, CVEs, IBANs, VINs, and tracker IDs — and gathers them into their own columns in the dossier, so the connections between findings become visible without you transcribing anything by hand.

  5. Export the dossier

    When you're ready, export the case as a finished dossier in the format that fits what comes next.

Auto-harvesting, and what it skips

You don't have to catalog a case by hand. When you file a result, OSINT classifies every value inside it and drops the pivotable ones into the matching dossier column. Two things it deliberately does not harvest: values that describe the answer rather than the subject (a reputation lookup's feed name or malware-family label looks like a domain but isn't your target), and secrets. Anything a finding contains that looks like a credential is redacted before it's stored, so a case never becomes a second place your own secrets end up sitting in plain text.

Assistant findings carry a grounding verdict

A finding the AI assistant writes into a case (rather than one you filed by hand from a tool result) also carries a grounding verdict — grounded, partial, unsupported, or not-checkable — recording how much of what it wrote was actually backed by tool output it ran. That verdict travels with the finding into the dossier, so a report never presents an assistant's inference with the same weight as a lookup a tool actually performed.

Export formats

A clean text report you can paste into notes, a ticket, or another document. Findings are laid out as readable sections with their fields summarized (large tables and deep structures are trimmed to a readable depth rather than dumped raw), each with its severity, source, and timing. Best when the report is headed into another document or a plain-text workflow.

What every format contains

Whatever the format, a dossier reflects the case behind it: every finding you chose to keep, with its input, its result, its severity, its sources, and when it was saved; and the identifiers the workbench harvested from those findings, gathered into the dossier's fields so the shape of the investigation — not just its raw output — comes through.

Your case stays with you

A case lives on your machine like the rest of your work. Nothing is uploaded — exporting a dossier is you choosing to write it out, not the app sending it anywhere. See Privacy.

Command Palette

Search for a command to run...