OSINT Orchestrator

• 

  OSINT Orchestrator: open-source due diligence from web evidence to a signed report, on Nebius Token Factory and NVIDIA Nemotron.

• 

  Pipeline: Collect, Qualify, Synthesise, Sign. MIT licence, Python, FastAPI and React, with the code on GitHub.

• 

  The problem: due diligence is still manual. Many tabs, copy-paste, no audit trail and no periodic re-checks of counterparties.

• 

  Setup: four lines of .env for Nebius Token Factory. Nemotron 3 Nano qualifies evidence; Nemotron 3 Super writes the risk assessment.

• 

  Observables extracted from the run (domains, emails, URLs), with the handoff panel to verify, export and follow up.

• 

  Targets view: searchable inventory of monitored entities with their collectors, last run, status and risk level.

• 

  Each decision is recorded in the history, and the final report is issued as numbered versions with a PDF download.

• 

  Compliance dossiers: record the entity, identifier, jurisdiction, and the purpose and authorized scope of the check.

• 

  Operator dashboard: active runs, 24h activity, success rate, median run time, targets at risk and targets by attention.

• 

  My account: change password and end sessions, plus an account administration section to manage operator users.

• 

  Alerts: open cases raised when a run finds new observables, with target, reason, risk, and acknowledge or resolve actions.

• 

  Handoff: verify the evidence chain, download the signed bundle or PDF report, copy a summary or start a follow-up run.

• 

  Manifest tab: SHA-256 hash of each artifact, run metadata and an HMAC signature that seals the run.

• 

  Issued versions can be reopened with a reason while prior versions are kept; the action history logs every step by user.

• 

  Evidence and professional decisions: the reviewer confirms or dismisses each match, and must give a written reason.

• 

  Run summary for a fictitious sample entity: risk level, justification, what is new since the previous run, and suggested pivots.

• 

  Run review: all five stages complete. Qualified evidence lists category, relevance, confidence, source and rationale for each item.

• 

  Generated Markdown report: risk, new findings, qualified evidence table, a note that confidence is declared, and collector status.

Inspiration

Open-source due diligence is still mostly manual. An analyst searches registries, news and infrastructure data, pastes the results into a document and writes a conclusion. That works once. It does not work when the same entity has to be re-checked every month, and it leaves no record of which sources were consulted, what they said that day, or whether the file was edited afterwards. Compliance teams and non-financial obliged entities (notaries, real-estate agents, small exchanges) feel this most, because they rarely have the budget for commercial screening platforms.

I work at SENACLAFT, Uruguay's national AML/CFT secretariat, so I see this gap up close. OSINT Orchestrator is a personal open-source project: I wanted a tool that a small AML/CFT team could run on its own infrastructure and later defend in front of a supervisor.

What it does

OSINT Orchestrator researches an authorised entity in public sources, on a schedule or on demand, and produces a signed, auditable report.

1. Collect. OpenOSINT and SpiderFoot run for every target. Tavily, Amass and SocialOSINT are opt-in per target, so nothing reaches a third party unless that target asks for it.
2. Qualify. Each web result is classified against the entity by NVIDIA Nemotron: category (sanctions, litigation, adverse media…), relevance, confidence and a one-line rationale.
3. Normalise. Findings become STIX 2.1 objects with deterministic ids, ready for OpenCTI.
4. Synthesise. A risk level with its justification, citing the evidence it relies on, plus what changed since the previous run.
5. Seal. Every file of the run is hashed into an HMAC-signed manifest chained to the previous run, so a later edit or deletion is detectable.

An operator console (Spanish/English) shows what needs attention, active runs, findings and evidence. Compliance dossiers keep the runs they rely on, the reason behind every confirmed or dismissed item, and versioned final reports signed off by an accountant role, never by the administrator who opened the dossier.

How we built it

Python orchestrator in Docker Compose, with SpiderFoot over HTTP and Amass/SocialOSINT as sidecars. The LLM layer talks to Nebius Token Factory through its OpenAI-compatible endpoint, with two independent routes:

• fast: nvidia/NVIDIA-Nemotron-3-Nano-30B-A3B qualifies each piece of evidence.
• reasoning: nvidia/nemotron-3-super-120b-a12b writes the risk synthesis for the run.

Both calls request a JSON-schema response, retry within a time budget, and every value is validated before it is stored. A target can stay on a local Ollama model instead (llm: local) when its data must not leave the premises. Requests, tokens and model availability are exported as Prometheus metrics.

Challenges

• Keeping the model honest about provenance: the console records which model qualified each item and which one wrote the conclusion, and the recorded showcase is labelled as such so it never credits a model that did not run.
• Making the evidence chain hold up: deterministic STIX ids and a manifest chained run to run, so the delta between two runs is reproducible.
• Data minimisation: collectors that contact third parties are off by default and enabled per target, and authorisation and purpose are mandatory fields written into every report.

What we learned

Small, fast models are good enough for per-item classification when the output is constrained by a schema; the larger reasoning model earns its cost only at the synthesis step. Splitting the two routes kept runs at about a minute.

What's next

Qualifying relationships between entities, data-quality indicators per source, NLP over filings and court records, and connectors to authoritative registries and sanctions lists.

Model output is an aid for an analyst, not a determination. MIT licence.

Built With

• docker
• nebius-token-factory
• nvidia-nemotron
• ollama
• opencti
• prometheus
• python
• spiderfoot
• stix
• tavily