Prismatic OSINT Sources

Prismatic OSINT Sources

260 files OSINT

Overview

Prismatic OSINT Sources manages the registry and lifecycle of all 121+ OSINT source adapters within the Prismatic Platform. It provides source discovery, health monitoring, capability querying, and unified access to all intelligence sources through a consistent adapter pattern protocol. Every adapter implements the same behaviour contract, ensuring that consumers can query any source -- from network intelligence to threat intelligence feeds -- through a single, uniform API without knowledge of source-specific authentication, pagination, or data format details.

The source registry maintains a capability-based catalog backed by ETS, enabling O(1) lookups when the platform needs to find all sources that support a particular query type such as IP reputation, domain intelligence, or sanctions screening. Each source entry tracks availability status, response latency percentiles, rate limiting quotas, and credential validity, providing the orchestration layer with real-time intelligence about which sources are healthy, cost-effective, and responsive for a given query.

Multi-source parallel querying enables the platform to fan out intelligence requests across multiple adapters simultaneously, collecting results through OTP supervision tree coordination and deduplicating findings with entity resolution algorithms. Source priority ordering and cost-aware selection ensure that expensive commercial APIs are queried only when free or lower-cost sources cannot satisfy the information requirement, optimizing operational costs while maintaining intelligence completeness.

Architecture

Query Request --> Source Selector --> Parallel Dispatcher --> Result Aggregator
      |                 |                     |                       |
  Capability         Priority          Per-Source Worker         Deduplication
  Requirements       Cost Model        Rate Limiter             Normalization
  Confidence         Availability      Circuit Breaker          Confidence Score
      |                 |                     |                       |
      +-----------------+---------------------+-----------------------+
                                  |
                           Source Registry (ETS) --> Health Monitor
                                  |
                           Credential Manager --> Auth Rotation

All source selection and result aggregation logic follows pure function principles. Network requests execute in isolated worker processes with circuit breaker patterns and backpressure mechanisms preventing cascade failures when individual sources become unavailable.

Key Modules

ModuleResponsibility
PrismaticOsintSourcesPublic facade: list/1, with_capability/1, query/2, health_report/0
PrismaticOsintSources.ApplicationOTP application entry point with registry and health monitor supervision
PrismaticOsintSources.RegistryETS-backed source catalog with capability indexing and O(1) lookups
PrismaticOsintSources.SourceSelectorCost-aware, quota-aware source selection with priority ordering
PrismaticOsintSources.ParallelDispatcherConcurrent multi-source query execution with timeout management
PrismaticOsintSources.ResultAggregatorCross-source result deduplication, normalization, and confidence scoring
PrismaticOsintSources.HealthMonitorPer-source availability tracking with degradation and recovery detection
PrismaticOsintSources.CredentialManagerAPI key rotation, OAuth2 token refresh, and credential validation
PrismaticOsintSources.QuotaTrackerToken bucket rate limiting with per-source quota tracking and forecasting

Key Features

Source Registry

The ETS-backed registry provides instant capability-based source discovery with structured metadata:

defmodule PrismaticOsintSources.Registry do
  @spec register(atom(), SourceSpec.t()) :: :ok
  def register(source_id, spec) do
    :ets.insert(@registry_table, {source_id, %{
      capabilities: spec.capabilities,
      status: :healthy,
      latency_p50: 0,
      latency_p99: 0,
      quota: spec.quota,
      cost_tier: spec.cost_tier,
      auth_type: spec.auth_type,
      registered_at: DateTime.utc_now()
    }})
    :ok
  end

  @spec with_capability(atom()) :: list(atom())
  def with_capability(capability) do
    :ets.foldl(fn {source_id, meta}, acc ->
      if capability in meta.capabilities, do: [source_id | acc], else: acc
    end, [], @registry_table)
  end

  @spec healthy_sources() :: list(atom())
  def healthy_sources do
    :ets.foldl(fn {source_id, meta}, acc ->
      if meta.status in [:healthy, :degraded], do: [source_id | acc], else: acc
    end, [], @registry_table)
  end
end
  • Centralized catalog of all 121+ OSINT sources with capability metadata and health status
  • Capability-based source discovery enabling queries like "find all sources supporting IP reputation lookup"
  • Health monitoring and availability tracking with automatic source degradation and recovery detection
  • Rate limit management per source with token bucket algorithms and quota tracking

Adapter Protocol

Every OSINT source adapter must implement the SourceAdapter behaviour, ensuring consistent interfaces:

CallbackPurposeReturn Type
capabilities/0Declare supported query typeslist(atom())
query/2Execute a query against the source`{:ok, list(Finding.t())}
health_check/0Verify source availability`:healthy
rate_limit/0Report current quota status%{remaining: integer(), resets_at: DateTime.t()}
normalize/1Convert source response to common schema{:ok, NormalizedResult.t()}
  • Unified protocol interface for all OSINT queries with structured request/response contracts
  • Structured result normalization converting source-specific formats to platform-standard schemas
  • Error handling with source-specific context including retry recommendations and degradation status
  • Credential and authentication management supporting API keys, OAuth2, and certificate-based auth

Source Orchestration

  • Multi-source parallel querying with configurable concurrency limits and timeout policies
  • Result deduplication across sources using entity resolution and confidence scoring
  • Source priority and fallback ordering with cost-aware selection minimizing API expenditure
  • Telemetry emission for query latency, source utilization, and cache hit metrics

Cost Optimization

The cost model ensures that expensive commercial APIs are queried only when necessary:

Cost TierSourcesQuery StrategyExamples
FreePublic APIs, open databasesAlways query firstcrt.sh, NVD, OFAC
LowFreemium with generous quotasPreferred after free tierShodan (free plan), VirusTotal
MediumCommercial with moderate quotasQuery when free/low insufficientSecurityTrails, BinaryEdge
HighPremium commercial APIsQuery only for high-priority requestsCensys Enterprise, IntelX

Source Categories

CategorySourcesExamples
Network Intelligence15+Shodan, Censys, BinaryEdge
Domain/DNS10+SecurityTrails, WHOIS, crt.sh
Threat Intelligence12+VirusTotal, OTX, ThreatFox
Business/Financial8+ARES, Open Corporates, OFAC
Czech Registries15+Justice.cz, CEDR, RZP
Breach/Leak5+HIBP, DeHashed, IntelX
Vulnerability6+NVD, Exploit-DB, OSV

Usage

# List all available sources with health status
{:ok, sources} = PrismaticOsintSources.list(include_health: true)
# => [%{name: "shodan", status: :healthy, latency_p99: 230}, ...]

# Query by capability
{:ok, sources} = PrismaticOsintSources.with_capability(:ip_lookup)
# => [%{name: "shodan"}, %{name: "censys"}, %{name: "binary_edge"}]

# Unified multi-source query with parallel execution
{:ok, results} = PrismaticOsintSources.query("example.com",
  sources: [:shodan, :censys, :crtsh],
  parallel: true,
  deduplicate: true
)
# => %{findings: [...], sources_queried: 3, confidence: 0.89}

# Check source health across all adapters
{:ok, health} = PrismaticOsintSources.health_report()
# => %{healthy: 98, degraded: 3, unavailable: 2, total: 103}

# Register a new source adapter
:ok = PrismaticOsintSources.register(:new_source, %{
  capabilities: [:ip_lookup, :domain_lookup],
  cost_tier: :low,
  auth_type: :api_key
})

NABLA Compliance

NABLA AxiomSource Registry EnforcementImplementation
Provenance MandatoryEvery finding traceable to specific source adapterSource ID and query timestamp on all results
Signal PluralityMulti-source queries enforced for reliable intelligenceSourceSelector enforces minimum source count per query type
Source IndependenceEach adapter operates in isolationPer-source supervised process, independent credentials, separate rate limits
Time DecaySource data freshness tracked and reportedHealth monitor tracks last successful query and data age per source
Contradiction PreservationConflicting results from different sources preservedResultAggregator maintains per-source findings without forced resolution

Testing

Registry tests verify ETS-backed source registration, capability indexing, and O(1) lookup performance. Source selection tests verify cost optimization, quota awareness, and plurality enforcement. Parallel dispatcher tests verify concurrent query execution, timeout handling, and error isolation across sources.

Health monitoring tests verify degradation detection, recovery triggering, and alert emission. Integration tests exercise the full pipeline from capability query through parallel dispatch to deduplicated result aggregation. Adapter contract tests verify behaviour compliance across all 121+ source adapters.

Integration Points

ApplicationRelationship
Prismatic OSINT CoreCore OSINT infrastructure consuming source registry data for query routing
Prismatic OSINT BusinessBusiness intelligence adapters registered as sources
Prismatic OSINT EU InstitutionsEU data adapters registered in the unified source catalog
Prismatic OSINT NetworkNetwork intelligence adapters for attack surface discovery
Prismatic PerimeterEASM consuming multi-source intelligence for security rating
Prismatic Storage ETSETS-backed source registry with sub-millisecond lookups

Performance

OperationLatencyNotes
Source registry lookup< 1msETS-backed O(1) capability query
Capability-based discovery< 5msETS fold across registry
Health report generation< 10msAggregation across all sources
Parallel multi-source query1-10sDepends on slowest source
Result deduplication< 100msEntity resolution across source results
Credential rotation< 50msToken refresh with cached fallback

Telemetry events: [:prismatic, :osint_sources, :query_dispatched], [:prismatic, :osint_sources, :source_health_changed], [:prismatic, :osint_sources, :quota_consumed].


Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL