Open Source Intelligence Corporate Training
Learn to investigate across the open web: people, domains, breaches, and threat actors.
This instructor-led program builds hands-on OSINT skill for security teams, from collection planning and source evaluation to link analysis, attribution, and finished intelligence reporting.
Instructor-led group trainingVirtual / on-site / off-site10 languagesDelivered inEnglish, Spanish, Mandarin, German, Arabic, Portuguese, Hindi, French, Japanese, Italian100+ countriesWe have delivered inUnited States, United Kingdom, India, Canada, Germany, France, Netherlands, UAE, Saudi Arabia, Singapore, Australia, Japan, Brazil, South Africa and 90+ more countries
How we build a team that investigates with open sources
The Edstellar OPEN SOURCE INTELLIGENCE Capability Model
Diagnose collection maturity
Skill checks map your team's current research habits, tooling, and evidence handling before training begins.
Standardize lawful methods
The team aligns on legal boundaries, source evaluation, and documentation standards for every investigation.
Practice with guided labs
Hands-on labs walk analysts through web, social, and technical collection in a sandboxed range.
Measure investigation quality
The capstone investigation shows how well analysts fuse sources, judge confidence, and brief findings.
Scale to live cases
Post-training playbooks and templates help the team apply OSINT methods to real alerts and cases.
Need more than one program?Get a group quote
Trusted as a Leading Corporate Training Provider by
Program Overview: What is Open Source Intelligence?
Open Source Intelligence is Edstellar's instructor-led technical program for security analysts, investigators, and threat intelligence teams working with publicly available information. Participants learn OSINT foundations and collection planning, web and social media intelligence, technical OSINT on domains and infrastructure, and analysis with attribution. The program builds disciplined, ethical open-source investigation skill.
Training is built around real investigations. Participants plan collection against a live target scenario, harvest web and social media intelligence, and trace domains, infrastructure, and breach data in guided labs. Instructors coach the team through analysis tradecraft, attribution discipline, and writing defensible intelligence reports, reviewing every finding with direct feedback. The program closes with a capstone: a complete full-cycle OSINT investigation.
Analysts drown in open-source data but struggle to turn it into intelligence: collection without a plan, tools without tradecraft, findings without evidence. This program teaches teams to investigate methodically, attribute carefully, and report clearly. Raw data becomes decision-grade intelligence.
The capstone is a full-cycle OSINT investigation run to professional standards: a collection plan, web and social intelligence gathering, technical tracing of domains and infrastructure, careful analysis with cautious attribution, and a written intelligence report graded on evidence. Your analysts keep the report and the tradecraft templates as their standard for every investigation after.
Across 20 hours, the program moves from collection planning and source evaluation through hands-on investigation labs to link analysis, attribution, and a full-cycle capstone investigation your team briefs to stakeholders.
What's Included in this Workshop for Your Enterprise Teams
- 1
20 hours of instruction
Five modules from collection planning to a full-cycle capstone investigation.
- 2
Guided investigation labs
Hands-on practice across web, social, technical, and dark web sources.
- 3
Analyst-grade tooling
Workflows your team can repeat with free and common OSINT tooling.
- 4
Finished intelligence output
Every analyst produces a briefed investigation report by the end.
- Instructor-led delivery across virtual, onsite, and hybrid
- Pre-training skill check to baseline the cohort
- Sandboxed lab range for every investigation exercise
- Lab guides, source checklists, and report templates
- Capstone investigation with instructor feedback
- Post-training support for your first live cases
Build your team's skills. Anywhere in the world.
Real-world use cases
from day one
Instructor-led training
for your teams
Delivered globally
in 100+ countries
Enterprise Training Solutions Customized for Your Company
One partner for instructor-led corporate training, delivered the way your teams work.
Request a Training Quote- Customized Training Delivery
- Scale Your Training: Small to Large Teams
- In-person Onsite, Live Virtual or Hybrid Training Modes
- Plan from 2000+ Industry-ready Training Programs
- Hands-On Labs on Live Infrastructure, Led by Industry Experts
Open Source Intelligence Course Topics and Program Outline
Five modules take your team from collection planning to a full-cycle investigation, with guided labs in every module.
Built by Edstellar with intelligence practitioners
Built by practitioners who run OSINT investigations in production, shaped around your stack and use cases.
Skill checks baseline your team's research habits and tooling before the first collection exercise.
Learn collection planning, legal boundaries, and source evaluation through instructor-led sessions.
Practice web, social, and technical collection in guided labs inside a sandboxed investigation range.
Apply everything in a full-cycle capstone investigation and brief your findings to stakeholders.
From first search query to a briefed intelligence report your stakeholders can act on.
Delivered as
Delivered instructor-led across virtual, onsite, and hybrid formats, with all labs run in a sandboxed range.
Build a collection plan for a fictional company target and list your legal boundaries.
learna)The intelligence cycle and legal boundaries for OSINT work
b)Defining collection requirements and target profiles
c)Search operators, public records, and registry sources
d)Evaluating source reliability and spotting bias
Run a guided social media investigation on a training persona and produce a timeline.
practicea)Advanced search techniques across engines and archives
b)Social media investigation workflows and account discovery
c)Geolocation, image verification, and timeline building
d)Archiving pages and preserving evidence properly
Profile a lab domain end to end, from DNS to breach exposure, in a sandboxed range.
practicea)DNS records, WHOIS, and domain registration intelligence
b)Certificate transparency logs and passive DNS pivoting
c)Breach data, credential leaks, and exposure checking
d)Mapping IP ranges, hosting, and attack surface from public data
Chart a threat actor network from provided data and draft an intelligence summary.
applya)Link analysis, entity resolution, and charting relationships
b)Attribution methods and expressing confidence levels
c)Writing threat intelligence reports buyers can act on
d)Monitoring the dark web for brand and data mentions
Complete a timed capstone investigation and present a finished intelligence briefing.
applya)Scoping a live investigation with a time-boxed plan
b)Collecting across web, social, and technical sources
c)Fusing findings into an entity and timeline picture
d)Delivering the intelligence briefing to stakeholders
Customize this program tailored to your team?
Tell us your training needs: what your team already works with, the level they’re at, and the topics you want them to focus on. We’ll adjust the modules, duration and hands-on labs, and send you a customized outline for your group.
Key Skills and Outcomes Your Team Will Gain
Practical capabilities your team practices in guided labs and demonstrates in the capstone investigation.
Plan OSINT collections
Define collection requirements and target profiles that keep investigations focused and lawful.
Investigate the open web
Use advanced search, archives, and public records to find people, posts, and documents.
Verify media and locations
Geolocate images and verify social media content before treating it as evidence.
Pivot on technical indicators
Move from domains and IPs to infrastructure maps using DNS, certificates, and breach data.
Analyze and attribute
Build link charts, resolve entities, and express attribution with honest confidence levels.
Write finished intelligence
Produce clear, judged intelligence reports and brief them to decision makers.
Preserve lawful evidence
Archive sources and document methods so findings hold up under review.
Teams that Benefit from this Open Source Intelligence Group Training
Built for security, investigations, and IT teams that research people, domains, and incidents. Content adapts to each cohort's role and experience so every team practices the workflows it owns.
Sharpen investigations with open-source evidence
SOC and security engineers learn to enrich alerts with OSINT, cutting triage time on phishing and fraud cases.
Workflow friction
- Thin context on alerts
- Slow manual lookups
- Unverified third-party data
How the program helps
- Faster alert enrichment
- Richer phishing investigations
- Evidence-backed escalations
Practice use cases
- alert enrichment
- phishing triage
- domain pivoting
Produce finished intelligence from open sources
Threat intel analysts practice collection, link analysis, and reporting workflows they can reuse on live cases.
Workflow friction
- Scattered collection habits
- Weak source validation
- Reports that lack judgment
How the program helps
- Structured collection plans
- Confident attribution calls
- Actionable intel reports
Practice use cases
- actor tracking
- breach monitoring
- intel reporting
Trace attackers with infrastructure intelligence
Responders learn to pivot from indicators to infrastructure, mapping attacker assets during active incidents.
Workflow friction
- Indicator dead ends
- Slow infrastructure pivots
- Missing attribution context
How the program helps
- Faster attacker mapping
- Stronger indicator context
- Defensible evidence chains
Practice use cases
- indicator pivoting
- asset mapping
- timeline building
Support fraud and insider cases with OSINT
Investigators and risk teams learn lawful, documented techniques for background research and fraud support.
Workflow friction
- Ad hoc research methods
- Evidence handling gaps
- Unclear legal boundaries
How the program helps
- Documented lawful methods
- Stronger case files
- Repeatable research playbooks
Practice use cases
- background research
- fraud support
- case documentation
Cohorts can mix roles; labs include role-specific tracks so each analyst practices their own workflows.
Prerequisites: Best suited for security analysts, investigators, and IT staff who research incidents or threats. Familiarity with web search and basic networking helps but is not required; no prior intelligence experience is needed. Labs adapt to each cohort's tools and cases.
Analyst to senior investigator
Analysts start with collection planning and search; senior investigators lead full-cycle cases and briefings.
A program that grows with investigation careers, from first searches to confident full-cycle cases.
Mixed cohort, or several teams at once?
We can tailor the training to different teams, roles, and experience levels within the same program.
Certificate of Training Completion.
On successful completion, employees receive an Edstellar course completion certificate, recognizing their commitment to ongoing learning and professional development. It validates the skills they have built and motivates them to keep growing and contribute to organizational success.
Earned, not attended. Awarded on completion of all hands-on labs and the capstone project.
Training Delivery Modes: Virtual, Onsite and Hybrid
Instructor-led Open Source Intelligence training delivered in the format that fits your team's schedule and location.
Hybrid Training
Part of your team joins in person while others attend live online, with shared labs for everyone.
- Live instructor across both audiences
- Shared sandboxed lab range
- Same curriculum and capstone
- Flexible scheduling across time zones
Onsite Training
The full program runs at your location, keeping the team together for exercises and the capstone.
- Instructor at your office
- Team exercises in one room
- Labs on your network option
- Private cohort discussions
Live Virtual Training
Live virtual sessions with breakout labs and instructor support throughout the investigation exercises.
- Live instructor-led sessions
- Breakout rooms for labs
- Screen-share investigation reviews
- Recordings for revision
Need a training format that works for your team?
Full days, half days across weeks, or split by module. Tell us the delivery window and we schedule the cohort around it.
Frequently Asked Questions
Share your team size, timelines, and delivery preference, and we will send a tailored quote for your cohort.
Yes, a short discovery call helps us map the program to your team's tools, cases, and skill gaps before booking.
Yes, live virtual delivery is available worldwide, with the same guided labs and instructor support as onsite.
Yes, onsite delivery runs at your location for teams that want everyone in the same room for the exercises.
The program runs 20 hours, typically over three days, and can be compressed or spread across weeks.
Question not answered here?
Put it in the request. A training specialist answers it directly, within one business day.
Where this Training Fits in Your Team's learning path.
OSINT comes after cyber basics and before threat intelligence. Your team learns to gather and verify public information safely, then uses it to build intelligence on threat actors and to find exposures attackers could see from the outside.
Why Choose Edstellar as Your Open Source Intelligence Training Provider
Edstellar delivers Open Source Intelligence training that turns analysts into investigators, with labs and methods your team keeps using.
EXPERT TRAINERS
YEARS DELIVERING
ORGANIZATIONS TRAINED
CERTIFIED
Tailored
Every cohort's labs, case studies, and collection scenarios are tuned to your team's investigations and tools.
Proven Methodology
A Diagnose to Scale arc moves your team from skill checks to live-case readiness with measurable checkpoints.
Practice-Based Learning
Analysts spend most of their hours in guided labs, investigating realistic targets in a sandboxed range.
Expert Trainers
Sessions are led by investigators who run OSINT cases in production, not lecturers reading slides.
Global Scale
Virtual, onsite, and hybrid delivery reaches your teams across regions with one consistent curriculum.
Measurable Outcomes
Capstone investigations and skill checks show exactly how far each analyst progressed.
Also from Edstellar
Talent assessments
Psychometric, behavioral, leadership and 360-degree assessment.
→Training needs analysis
Needs analysis, gap identification, and a training roadmap.
→L&D consulting
Learning strategy, content, technology and ROI measurement.
→OD consulting
Org design, succession planning and cultural change.
→Managed training services
Training outsourcing, vendor management, logistics and administration.
→Coaching solutions
Executive and manager coaching that keeps skills in use.
Start an RFP shaped to your needs.
Answer three quick questions about team size, scope, and how often you need the program run, then send the request from the last step. Everything you choose travels with it, so you only fill this in once.
How many team members need training?
Open Source Intelligence Training Packages & Pricing
Where L&D holds an annual budget, license packages price the whole year at once instead of raising a purchase order per workshop. Hours and licenses are pooled across teams, programs and locations, so unused capacity is not stranded in one department.
Starter
120
trainee licenses64 hours of group training
Tailored for SMBs
Growth
320
trainee licenses160 hours of group training
Ideal for growing SMBs
Enterprise
800
trainee licenses400 hours of group training
Designed for large corporations
Custom
Unlimited
trainee licensesDuration set by the rollout
Multi-region and multi-year
Training Packages & Pricing
Choose the training format that works for your team. Pricing is customized based on your requirements, cohort size, and delivery needs.
Request Open Source Intelligence Training for Your Team
Tell us about your team size, timelines, and the investigations you want the program to cover.