# How to use OSINT Framework in six steps, from input to alert

> Pick the branch for what you have, read the markers and the panel, run the lookup, keep evidence, then let AyeWatch watch what will change.

URL: https://claudegpt.si/news/how-to-use-osint-framework-six-steps  
Published: 2026-11-04T05:34:41.328Z  
Author: ClaudeGPT Si Newsroom  
Section: Guides  
Topics: OSINT Framework, OSINT, How to  
Publisher: ClaudeGPT Si

## Key takeaways

- OSINT Framework is sorted by input, so start from what you have, a username, domain, email, image or company, and open that branch.
- Each tool's panel shows a status badge, a pricing badge and an OPSEC note that says whether the tool is passive or contacts the target.
- For sources you will check again, AyeWatch sends a short summary with links when they change; paid plans start at $9 a month.

Here is how to use OSINT Framework: start from the one thing you already have, such as a username, a domain or a company name, open the branch for it, read the markers and the tool panel, then run the lookup on the tool's own site. When the answer will need checking again next week, hand that part to a monitor like AyeWatch instead of bookmarking ten tabs.

Here is the whole routine in six steps, then a worked example.

## Step 1: write down your input and your question

The tree at [osintframework.com](https://osintframework.com) is sorted by input, so decide what you are holding before you click anything. "We have a domain and want to know what else runs on it" leads somewhere very different from "we have a company name and want its filings."

| If you have | Open this branch |
| --- | --- |
| A username or handle | Username |
| An email address | Email Address |
| A website or domain | Domain Name |
| A photo, video or document | Images / Videos / Docs |
| A company name | Business Records |
| An old or deleted page | Archives |

## Step 2: open the branch

Click the branch name and the tree unfolds into sub-branches, then into tools. If you already know the tool's name, type it in the search box at the top instead; it matches names and descriptions.

## Step 3: read the markers before you click

Letters after a name change what happens next. (T) means you install and run the tool on your own machine. (D) is a Google dork, a prepared search query. (R) means you have to register. (M) means the search term sits inside the URL and you edit it by hand.

## Step 4: check the panel

Clicking a tool opens a side panel instead of leaving the page. Look at three things: the status badge (live, degraded or down), the pricing badge (free, freemium or paid), and the OPSEC note. A passive tool reads data that already exists; an active one sends requests to the target, which the target may notice. The panel also lists the input the tool expects and the output you get back. Then press "Open Tool".

## Step 5: run it and keep evidence

Do the lookup on the tool's site and record what you found, with the date. The tree has a Documentation / Evidence Capture branch for this, and the Wayback Machine's Save Page Now keeps a copy of a single page in case it gets edited later.

## Step 6: turn repeat checks into alerts

Most findings are snapshots. If you need to know when a changelog, a press page or a public account posts something new, set it up in [AyeWatch](https://ayewatch.ai/pricing), which has a free preview and paid plans from $9 a month. Describe what you care about in plain English or paste the URL, and it messages you with a short summary and source links when something relevant appears. Following a public X account this way needs no X login.

## Worked example: a startup that just launched

Say a startup everyone on your timeline is posting about just shipped, and you want to see what is behind the launch thread.

1. Domain Name, then Certificate Search, then crt.sh: search its domain to see which subdomains have certificates, such as a staging or docs site.
2. Archives, then the Wayback Machine: compare its pricing page with earlier captures.
3. Business Records: look up the registered company on OpenCorporates, and on SEC EDGAR if it is publicly listed.
4. AyeWatch: watch the pricing page, the changelog and the company's public X account, so the next change reaches you instead of the other way round.

For a single quick lookup, the search box gets you there faster than the full routine, and a monitor only pays off for things you will check again.

## Keep it legal

Research companies, products and your own footprint. Follow each site's terms and your local law, and never use the framework to follow or profile private people.

## Frequently asked questions

### What do T, D, R and M mean in OSINT Framework?

(T) is a tool you install and run locally, (D) is a Google dork, (R) needs registration, and (M) means you edit the search term into the URL by hand.

### Can I search OSINT Framework?

Yes. The search box at the top of the tree matches tool names and descriptions, and picking a result takes you to that tool in the tree.

### Is it legal to use OSINT Framework?

Using public sources is generally lawful, but each site's terms and your local law apply. Research organizations and your own exposure, and do not track private people. This is not legal advice.

## Sources

- [OSINT Framework](https://osintframework.com), OSINT Framework
- [lockfale/osint-framework README](https://github.com/lockfale/osint-framework), GitHub
- [AyeWatch pricing](https://ayewatch.ai/pricing), AyeWatch
- [Monitor X accounts with AyeWatch](https://ayewatch.ai/x), AyeWatch
- [crt.sh certificate search](https://crt.sh), Sectigo
- [Using the Wayback Machine](https://help.archive.org/help/using-the-wayback-machine/), Internet Archive
- [OpenCorporates](https://opencorporates.com), OpenCorporates
- [EDGAR search and access](https://www.sec.gov/edgar/search-and-access), U.S. Securities and Exchange Commission