Prismatic OSINT Network

Overview

Prismatic OSINT Network provides adapters for network-focused intelligence sources, integrating with platforms such as Shodan, Censys, BinaryEdge, SecurityTrails, and GreyNoise to collect data about IP addresses, domains, DNS records, open ports, and network infrastructure. Each external source is accessed through a standardized adapter that normalizes data into a common schema, enabling uniform querying regardless of the originating platform.

Network intelligence forms the backbone of attack surface discovery. When Prismatic Perimeter evaluates an organization's external exposure, it relies on OSINT Network adapters to enumerate subdomains, identify exposed services, correlate IP addresses with autonomous systems, and track certificate transparency logs. The resulting data feeds directly into security rating algorithms in Prismatic Perimeter Core.

The module implements intelligent source orchestration. Rather than querying all sources for every request, it selects the optimal combination of sources based on the query type, data freshness requirements, and API quota availability. Source responses are cached with configurable TTLs and cross-validated for consistency, adhering to the platform's signal plurality requirements under the NABLA framework.

Architecture

Query Interface --> Source Selector --> Adapter Pool --> Response Normalizer --> Cache
       |                |                |                 |               |
  IP/Domain Query   Quota Aware     Per-Source       Common Schema    TTL-Based
  Infrastructure    Freshness       Rate Limiting    Confidence       ETS Store
  DNS/WHOIS         Type Matching   Error Handling   Scoring          Invalidation

Each adapter runs as a supervised process with its own rate limiting state, ensuring that API quotas are never exceeded even under concurrent query load. The adapter pattern follows the platform's storage adapter design from Prismatic Storage Core.

Key Modules

Key Features

IP Intelligence

Comprehensive IP address analysis combines data from multiple network intelligence sources into a unified profile with confidence scoring:

defmodule PrismaticOsintNetwork.IpIntelligence do
  @spec analyze(String.t(), keyword()) :: {:ok, IpProfile.t()} | {:error, term()}
  def analyze(ip_address, opts \\ []) do
    sources = SourceSelector.select_for(:ip_lookup, opts)

    results = Task.async_stream(sources, fn source ->
      {source, query_adapter(source, :ip_lookup, ip_address)}
    end, max_concurrency: length(sources), timeout: 15_000)
    |> collect_results()

    merged = ResponseNormalizer.merge_ip_results(results)

    {:ok, %IpProfile{
      ip: ip_address,
      geolocation: merged.geo,
      asn: merged.asn,
      organization: merged.org,
      ports: merged.open_ports,
      services: merged.services,
      reputation: compute_reputation(results),
      sources: Map.keys(results),
      confidence: compute_confidence(results),
      last_seen: merged.most_recent_observation
    }}
  end
end

• Geolocation, ASN, and organization mapping from multiple sources with cross-validation
• Reverse DNS and PTR record resolution with history tracking
• Port and service enumeration with banner analysis and version detection
• Reputation scoring aggregated from threat intelligence feeds

DNS Intelligence

• Forward and reverse DNS resolution with DNSSEC validation status
• Historical DNS record tracking through passive DNS databases
• Passive DNS database queries across SecurityTrails, VirusTotal, and others
• Zone transfer detection and DNS configuration analysis

Infrastructure Mapping

The infrastructure mapping capability assembles a complete picture of an organization's external-facing systems:

• Subdomain enumeration across certificate transparency, DNS, and web sources
• Certificate transparency log monitoring for new certificate issuances
• WHOIS and registration data aggregation with change tracking
• Technology stack fingerprinting from HTTP headers and response analysis

Source Orchestration

The source selector implements cost-aware, quota-aware selection to minimize API expenditure while maximizing intelligence completeness:

defmodule PrismaticOsintNetwork.SourceSelector do
  @spec select_for(atom(), keyword()) :: list(atom())
  def select_for(query_type, opts \\ []) do
    all_capable = sources_supporting(query_type)
    freshness = Keyword.get(opts, :freshness, :standard)
    budget = Keyword.get(opts, :budget, :optimal)

    all_capable
    |> filter_by_quota_availability()
    |> filter_by_freshness(freshness)
    |> sort_by_cost(budget)
    |> ensure_plurality(min: 2)
    |> Enum.take(max_sources(budget))
  end

  defp ensure_plurality(sources, min: min_count) do
    if length(sources) < min_count do
      Logger.warning("Insufficient sources for plurality: #{length(sources)}")
    end
    sources
  end
end

Integrated Sources

Usage

# Multi-source IP intelligence with automatic source selection
{:ok, intel} = PrismaticOsintNetwork.ip_intelligence("1.2.3.4")
# => %{geo: %{country: "US", city: "San Francisco"}, asn: 13335,
#       org: "Cloudflare", ports: [80, 443], reputation: 0.92}

# Comprehensive domain reconnaissance
{:ok, recon} = PrismaticOsintNetwork.domain_recon("example.com")
# => %{subdomains: 47, dns_records: [...], certificates: [...], technologies: [...]}

# Full infrastructure mapping with relationship graph
{:ok, infra} = PrismaticOsintNetwork.map_infrastructure("example.com")
# => %{hosts: 23, services: 89, certificates: 12, relationships: [...]}

# Check source API quota status
{:ok, quotas} = PrismaticOsintNetwork.quota_status()
# => %{shodan: %{remaining: 450, resets_at: ~U[...]}, censys: %{remaining: 230, ...}}

# Historical DNS analysis
{:ok, dns_history} = PrismaticOsintNetwork.dns_history("example.com",
  record_types: [:A, :CNAME, :MX], from: ~D[2024-01-01])

NABLA Compliance

Testing

IP intelligence tests verify multi-source data merging, geolocation accuracy, and ASN correlation against known IP address fixtures. DNS intelligence tests verify record resolution, historical tracking, and DNSSEC validation. Infrastructure mapping tests verify subdomain enumeration completeness, certificate monitoring, and technology fingerprinting accuracy.

Source orchestration tests verify quota management, cost optimization, and plurality enforcement. Integration tests exercise the full pipeline from multi-source query through normalization to cached result delivery. Adapter contract tests verify consistent behaviour compliance across all source adapters.

Integration Points

Performance

Telemetry events: [:prismatic, :osint_network, :query_completed], [:prismatic, :osint_network, :source_selected], [:prismatic, :osint_network, :quota_consumed].

Related Resources

• Prismatic OSINT Sources -- Source registry and API key management for all OSINT adapters
• Prismatic Crawler Core -- HTTP-based collection infrastructure for active scanning
• Prismatic Traits -- Network intelligence contributes to entity trait computation
• Competitor Researcher -- Leverages network intelligence for competitive infrastructure analysis
• Alert Management Specialist -- Manages alerts from network intelligence change detection
• Adapter Pattern Specialist -- Ensures OSINT source adapters follow consistent interface patterns
• Intelligence Synthesis -- Multi-source network intelligence fusion across Shodan, Censys, and others
• Real-Time Monitoring -- Continuous monitoring of network infrastructure changes
• NABLA Axioms -- Signal plurality enforced across independent network intelligence sources

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator