Investigations · 5 min read
Run tools from OSINT Search
Choose a dashboard tool, enter an identifier, then review and save useful results to your case.
Choose a tool on the dashboard
Open your case on the dashboard and expand OSINT Search. Choose a category, then use Select a tool to pick the lookup you need. Categories appear as Search, Domain, Security, Breach, Financial, and Crypto. Locked choices show the required plan and cannot be selected.
Tools are useful for a specific identifier or focused lookup. The Skill library provides prepared investigations with separate fields and a preview. Both can contribute evidence to the same case, but their launch steps differ.
| Category | Available tool choices |
|---|---|
| Search & Intel | Advanced Search; Username Discovery; Email Discovery; BLUF Analysis; Social Media Finder; Phone Intelligence |
| Domain & Network | WHOIS Lookup; IP Geolocation; Reverse IP Lookup; DNS Records; Domain Availability |
| Security & Threat | IP Reputation Check; Abuse Reports; Blacklist Download |
| Breach Intelligence | Email Breach Search; Username Search; Password Breach Check; Password Pivot Search; IP Address Search; Name Search; Phone Breach Search; Domain Breach Search; Address Search; VIN Search; Hashed Password Search |
| Financial Investigations | Offshore Officer Search; Offshore Entity Search; Intermediary Search; Offshore Address Search; Bank & Payment Intel; UK Company Registry; US Public Filings; Financial Instrument Mapping |
| Crypto Intelligence | Wallet Enrichment |
Enter the input and run
- Select the tool and read its description and input placeholder. Enter the requested name, domain, IP address, phone number, or other identifier.
- For Advanced Search, fill Name or terms and optionally choose a File type: None, PDF, DOC, DOCX, XLSX, or JPEG.
- Resolve any validation message, then select Run tool or press Enter. Blacklist Download uses the Download Blacklist button and does not need a subject input in the dashboard form.
- Read the result dialog, follow the investigation in case chat, or continue in Bank & Payment Intel, depending on the selected tool.
Category: Domain Tool: DNS Records Input: example.com Action: Run tool
Inputs that need particular care
- Wallet Enrichment: enter the wallet address followed by Ethereum, Polygon, or Base, for example 0x0000000000000000000000000000000000000000 Ethereum. Replace the illustrative address with your target.
- US Public Filings: enter the resolved SEC CIK. A company name is not the requested identifier.
- Financial Instrument Mapping: use ISIN or TICKER, optionally as ISIN: followed by the value or TICKER: followed by the symbol. Use the Skill guide for interpretation of ambiguous results.
- BLUF Analysis uses a one-year period from this tool. Use the BLUF situation brief Skill when you want to enter a different time window.
- Hashed Password Search accepts an MD5, SHA-1, or SHA-256 hash. Follow its validation message if the input is not a supported hash.
Use selected results in your case
In a result dialog, select individual items or use Select All. The selection count determines what is passed to the next action. Review the relevant source, dates, and subject match before saving a result.
- Add to Chat places the selected result content in chat for further work.
- Save to Case stores findings in the current case. If no case is open, Open Case to Save starts the case-creation flow with your selection.
- Add to Entity Graph is available when your plan permits it and the selection contains supported entities. Select an existing graph or create a named graph, then confirm Add to Graph.
Review WHOIS history
In a WHOIS result, select View History to inspect retained records for that domain. Where more than one record is available, choose Compare and select two records. Use Lookup Date to distinguish when a record was collected from dates within the registration itself.
A historical record can be opened for detail and its selected information saved with Save to Case or Open Case to Save. No history records found means there are no retained records available to that view; it does not establish that the domain never changed. Historical or redacted registration details require the same care as a current lookup.