Most OSINT investigations start with a person. Critical incidents often don't.

A public gathering begins organizing online. A counter-event appears. A local issue suddenly gains wider attention. The conversation moves between platforms, posts disappear, crowd estimates conflict, and investigators need to determine what is actually happening. This course teaches investigators to start with the event and work outward.

What students will learn:

Event-centered OSINT collection planning

Advanced web search and Google Programmable Search Engine workflows

Reddit and online community discovery

Platform and subculture mapping

Public network analysis: sources, organizers, amplifiers and connectors

Crowd estimation using multiple indicators and confidence ranges

Platform migration and real-time monitoring

Deleted, edited, reposted and resurfaced content analysis

Geolocation and media verification

Metadata and timestamp analysis

RSS, page-change detection, keyword monitoring and available APIs

Post-incident intelligence review

Local/offline investigative workflows

AI-assisted investigative tool development and validation

Browse Courses