Prismatic OSINT Social Media

Overview

Prismatic OSINT Social Media provides adapters for social media intelligence collection and analysis across major platforms. The module supports profile discovery from identifiers (email, username, phone), content monitoring with real-time keyword alerting, sentiment analysis on public posts, and network mapping of connections and follower relationships. Social media intelligence occupies a unique position in the intelligence landscape because it captures both structured metadata (profile attributes, connection graphs, activity timestamps) and unstructured content (posts, comments, opinions) that reveal behavioral patterns invisible to purely technical intelligence sources.

All collection respects platform terms of service, rate limits, and applicable privacy regulations including GDPR. The module operates exclusively on publicly accessible data and implements configurable data minimization policies to collect only what is necessary for the intelligence objective. Source attribution is maintained throughout the pipeline so that every piece of intelligence can be traced back to its origin for provenance verification. The NABLA framework's source independence axiom is enforced by weighting intelligence from multiple independent platforms higher than conclusions drawn from a single platform, reducing the risk of manipulation through platform-specific disinformation campaigns.

The social media adapters integrate with the broader OSINT pipeline through the Prismatic OSINT Core adapter protocol, enabling social media signals to be correlated with technical intelligence from sources like Shodan, Censys, and DNS records. When a social media profile mentions a server IP that also appears in infrastructure scans, the cross-domain correlation strengthens the intelligence picture with evidence from fundamentally independent source categories.

Architecture

PrismaticOsintSocialMedia.Application
+-- PrismaticOsintSocialMedia.Supervisor (:one_for_one)
    +-- Platform Router (GenServer)
    |   +-- Query type classification
    |   +-- Platform selection and dispatch
    |   +-- Capability-based routing
    |
    +-- Platform Adapters (per-platform GenServers)
    |   +-- Twitter/X Adapter
    |   |   +-- OAuth2 authentication
    |   |   +-- Rate limit management (per-endpoint)
    |   |   +-- Streaming API integration
    |   |
    |   +-- LinkedIn Adapter
    |   |   +-- Public profile extraction
    |   |   +-- Professional network mapping
    |   |
    |   +-- GitHub Adapter
    |   |   +-- Repository activity analysis
    |   |   +-- Contribution network mapping
    |   |   +-- Technical skill profiling
    |   |
    |   +-- Custom Platform Adapter (extensible)
    |
    +-- Normalization Layer (Module)
    |   +-- Profile schema normalization
    |   +-- Content format standardization
    |   +-- Network graph unification
    |
    +-- Analysis Subsystem
        +-- Profile Resolver (cross-platform identity)
        +-- Content Analyzer (NLP + sentiment)
        +-- Network Mapper (graph construction)

Query Interface
       |
  Platform Router
       |
  +----+----+----+----+
  |         |         |         |
Twitter  LinkedIn  GitHub   Custom
Adapter  Adapter   Adapter  Adapter
  |         |         |         |
  +----+----+----+----+
       |
  Normalization Layer
       |
  +----+----+----+
  |         |         |
Profile   Content   Network
Resolver  Analyzer  Mapper
  |         |         |
  +----+----+----+
       |
  Intelligence Output

Each social platform has a dedicated adapter that handles authentication, rate limiting, pagination, and response normalization. The Platform Router dispatches queries to the appropriate adapters based on the requested platforms and query type. Results pass through a normalization layer that produces uniform data structures regardless of source platform. All adapters implement the platform's OSINT provider protocol for consistent error handling, retry behavior, and credential management.

Key Modules

Key Features

Profile Intelligence

Profile discovery begins with a single identifier -- an email address, username, or phone number -- and systematically searches across configured platforms to build a unified cross-platform identity profile. Each platform adapter extracts available metadata (display name, bio, location, creation date, follower counts, activity frequency) and normalizes it to a common schema. The Profile Resolver then correlates results across platforms using deterministic matching (shared identifiers) and probabilistic matching (name similarity, shared connections, temporal activity patterns) to produce a consolidated entity profile with confidence scoring.

• Cross-platform profile discovery from email addresses, usernames, or phone numbers
• Profile metadata extraction and normalization to a unified schema
• Activity pattern analysis -- posting frequency, active hours, content themes
• Connection and follower network mapping with relationship strength scoring

Content Analysis

Content analysis applies NLP pipelines to public posts, comments, and replies collected from monitored platforms. The analysis extracts sentiment (positive, negative, neutral with intensity scoring), identifies named entities mentioned in content, detects language and provides translation for multilingual intelligence, and classifies content by topic categories relevant to the intelligence objective.

• Sentiment analysis on posts, comments, and replies using configurable NLP pipelines
• Topic extraction and trending analysis within monitored entity contexts
• Language detection with automatic translation for multilingual intelligence
• Temporal activity pattern detection for behavioral profiling

Monitoring

Continuous monitoring tracks entity mentions, brand references, and keyword appearances across configured platforms in near-real-time. The monitoring engine supports configurable alert thresholds for sentiment shifts, unusual activity spikes, and specific threat keywords. Geolocation-based content filtering enables region-specific intelligence collection for investigations with geographic constraints.

• Real-time keyword and entity mention monitoring across configured platforms
• Brand reputation tracking with sentiment trend visualization
• Threat and risk signal detection (leaked credentials, insider threats, targeting)
• Geolocation-based content filtering for region-specific intelligence

Network Mapping

Network mapping constructs social relationship graphs by traversing follower and following lists, extracting interaction patterns (mentions, replies, retweets), and computing relationship strength scores based on interaction frequency and reciprocity. The resulting graphs are stored in KuzuDB as social relationship edges that complement corporate ownership and infrastructure topology from other intelligence domains.

Configuration

config :prismatic_osint_social_media,
  # Platform configuration
  active_platforms: [:twitter, :linkedin, :github],

  # Rate limiting (per platform)
  rate_limits: %{
    twitter: %{requests_per_15min: 450, search_per_15min: 180},
    linkedin: %{requests_per_day: 100},
    github: %{requests_per_hour: 5000}
  },

  # Content analysis
  sentiment_engine: :nlp_pipeline,
  language_detection: true,
  auto_translate: false,

  # Monitoring
  monitoring_interval: :timer.minutes(5),
  alert_channels: [:pubsub, :webhook],

  # GDPR compliance
  data_minimization: true,
  retention_days: 90,
  pii_redaction: true

API Reference

# Cross-platform profile search from an email address
{:ok, profiles} = PrismaticOsintSocialMedia.find_profiles(
  email: "user@example.com"
)
# => {:ok, [%Profile{platform: :twitter, handle: "@user", ...}, ...]}

# Monitor entity mentions across platforms
{:ok, monitor} = PrismaticOsintSocialMedia.monitor(
  entity: "Example Corp",
  platforms: [:twitter, :linkedin],
  keywords: ["breach", "vulnerability", "lawsuit"],
  callback: &process_mention/1
)

# Sentiment analysis on collected posts
{:ok, sentiment} = PrismaticOsintSocialMedia.analyze_sentiment(posts)
# => {:ok, %{overall: :negative, score: -0.62, distribution: %{positive: 12, neutral: 8, negative: 30}}}

# Network mapping for a discovered profile
{:ok, network} = PrismaticOsintSocialMedia.map_network("@target_user",
  platform: :twitter,
  depth: 2,
  limit: 500
)
# => {:ok, %Network{nodes: 342, edges: 1_205, communities: 5}}

# GitHub technical skill profiling
{:ok, skills} = PrismaticOsintSocialMedia.github_profile("username")
# => {:ok, %{languages: %{"Elixir" => 45, "Python" => 30}, repos: 23, contributions: 1247}}

Testing

# Run all social media OSINT tests
cd apps/prismatic_osint_social_media && mix test

# Run with coverage
mix test --cover

# Run platform adapter tests
mix test test/prismatic_osint_social_media/adapters

# Run profile resolution tests
mix test test/prismatic_osint_social_media/profile_resolver_test.exs

# Run sentiment analysis tests
mix test test/prismatic_osint_social_media/content_analyzer_test.exs

Testing covers platform adapter authentication and rate limit compliance, profile normalization accuracy across platform-specific schemas, cross-platform identity resolution with both deterministic and probabilistic matching, sentiment analysis accuracy against labeled datasets, and network graph construction correctness. Mock adapters simulate platform API responses for deterministic testing without external dependencies.

Integration Points

NABLA Compliance

Performance

Related Resources

• Prismatic OSINT Core -- Adapter protocol and source registry
• Prismatic Modalities -- Multi-modal intelligence fusion from social content
• Prismatic Storage KuzuDB -- Social network graph storage
• Intelligence Synthesis -- Cross-platform social intelligence fusion
• Real-Time Monitoring -- Continuous social media monitoring
• NABLA Axioms -- Source independence weighting for multi-platform intelligence

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator