You are not searching. You are pivoting.

Most people arrive at OSINT thinking of it as searching — you have a name, you look it up, you read what comes back. That model breaks immediately, because the useful thing is almost never attached to the identifier you started with.

The actual mechanic is pivoting. You hold a selector — an email, a username, a domain, a registration number — and you ask a source what it knows about that selector. What comes back usually contains a different selector. You follow that one. And again.

Two things about that loop matter more than they look.

It starts with a requirement, not a selector. If you cannot say what decision your collection serves, you will pivot forever — every finding suggests three more, and none of them are wrong exactly, they are just not yours. The stopping condition is the requirement, not exhaustion.

Corroboration is a separate step from collection. Finding a thing once is not knowing it. Two sources that both copied the same original are one source wearing a hat.

Two problems that shape everything

If pivoting were the whole story, OSINT would be a research skill. It is not, because two problems sit underneath it, and almost every feature you are about to meet exists to answer one of them.

Problem one — they can see you looking

Every request you make somewhere leaves a trace somewhere. Visit a company's website and the company's logs record a visitor. If that visitor resolves to your employer's IP range, you have told the subject of your enquiry that they are the subject of an enquiry.

Worse: for the people this discipline is usually pointed at, being looked at is information. It tells them what you know, when you started, and how close you are.

Problem two — you have to prove what you saw

Findings that restrict someone's access, end their employment, or support a referral will be challenged. Months later, by someone hostile, working from your notes.

"I saw it on the site" is not a finding. The page has changed. The post is deleted. The account is gone. Without a record made at the time, with provenance attached, you have an assertion and a memory.

Hold those two. Every component in Part II is an answer to one of them, and it is worth asking which as you meet each one.

Three things that make it harder than it looks

A selector carries a type, and the type is not in the string

Consider 9909344990. Ten digits. To a search engine that is a phone number, and it will helpfully offer you reverse-lookup adverts. It is actually a Russian tax identification number, and knowing that turns it from noise into a jurisdiction.

This is not a hypothetical — it happened while this course was being built. The number only became useful when it was bound to context.

A username is not a person

Handles collide. Two people pick mhalden eleven years apart and neither is aware of the other. If you attribute one's activity to the other, you have not made a small error — you have made a false allegation, and the evidence against you was available the whole time in a registration date.

Nothing found is a result, not a gap

If you search and find nothing, you have learned something and it belongs in the record. An analyst who reports only hits produces a document that cannot be distinguished from one who did not look.

Agent — the loop, delegated

answers the pivot loop, at a speed you cannot match by hand

You give the Agent a sentence. It decomposes that into specific calls, runs them, reads what comes back, and proposes the next round based on what it learned. That is the loop from page 1, executed for you.

In the worked example you will meet later, one sentence became eleven actions across four rounds, pivoting from a company name to a registration number to a jurisdiction to named individuals.

Two things to hold onto.

It stops and asks. Before anything runs, it shows you each proposed call with its exact query and waits. You approve, or you do not. This is not a confirmation dialog — it is where you exercise judgement about proportionality, one action at a time.

You were not there. The Agent's output is fluent, sourced and confidence-labelled, which makes it read like observation. It is not. It is a report of what a system did on your behalf. That distinction becomes very important on page 8.

1234

Browser — the shield

answers problem one — they can see you looking

The Browser is not "the manual option". It is a sandboxed browser running somewhere else, so that when you look at something, what the target sees is the sandbox and not you.

Three things it gives you that a browser on your own machine cannot:

• Egress you choose. The request appears to come from a country you selected, not from your employer's netblock.
• An identity you selected. Sessions run as a persona from the Vault, not as you.
• Files that cannot reach you. Anything you open is opened over there. Nothing touches your endpoint.

And one thing that matters for problem two: when you look at something in the Browser, you looked at it. You can say so. That is a different kind of claim from anything the Agent produces, and later you will see a case where fifteen minutes of looking upgraded a delegated inference into an observed fact.

1234

Federation — what will accept your selector

answers the pivot loop — a selector is only useful if something will take it

Federation is the set of sources Glazer can ask on your behalf. Thirty of them. Each accepts particular selector types and returns particular things.

This is where page 3's lesson becomes operational. A service declares what it accepts — an email, a domain, a crypto_address. Handing it the wrong type does not fail loudly; it returns nothing, and nothing looks the same whether you asked wrongly or the answer is genuinely no.

Two habits worth forming now

• Passive first. Twenty-nine of the thirty are third-party lookups — you are asking someone else what they already know, and the subject never learns anything. Only one issues a live request. Exhaust the passive surface before touching anything.
• Cheap first. Federation is metered. Some sources cost meaningfully more than others, and the expensive ones are rarely the ones that answer your first question.

You will filter the full catalogue yourself on page 11.

Wayback — proving what you saw

answers problem two — you have to prove what you saw

Every navigation you make is recorded: what you visited, when, over which egress, from which country. That log is scoped to your project, and it is where you go months later when someone asks how you know.

The distinction that matters

Screenshots come in two kinds, and only one of them is evidence in the strong sense.

So the moment a finding matters — the one you expect to defend — click the button. That single act is the difference between "our system logged this" and "a qualified authority attests this existed at this time".

Vault — who you were at the time

answers problem one, and part of problem two

The Vault holds identities. A session runs as one of them, and which one is a decision you make before you start looking.

An identity is not only a login. It is a posture: attributable research identity for a declared, consented process; an aged persona for a venue where turning up as yourself would burn the enquiry and possibly you.

The part people miss

Identities can be transferred between users. That makes "who held this persona when the collection happened" a question your record has to be able to answer — which makes transfer a custody event, not an administrative convenience.

So the lifecycle is longer than most people write down:

Every persona needs a documented retirement trigger before it is deployed — the condition under which you stop using it. Deciding that afterwards is deciding it too late.

Three decisions before you look at anything

Launching a Browser session asks you three questions at once, and will not let you past until all three are answered. That is deliberate: collection posture is chosen before collection, not reconstructed afterwards.

• Which identity? From the Vault. Attributable, or a persona.
• Retain browsing data? Cookies, history, bookmarks. An evidentiary choice, not a convenience.
• Which egress? And under GVPN, from which country.

The routes

Tor is not simply "more secure". Exit reputation degrades some results and gets you blocked or served altered content elsewhere. Choosing it for a routine lookup is not caution, it is noise.

1234

Where you appear to be

Selecting GVPN reveals a country list. This is the control that turns "use a VPN" from advice into a decision, and it is worth two rules.

1. Never your own region. An egress in your home country defeats the entire purpose.
2. Plausible for the query. Ask who would routinely make this request from there. A German egress reading Russian corporate records is unremarkable trade-compliance behaviour. Somewhere regionally adjacent to the subject is a different signal.

The Agent does something else, and it is right to

The Agent picks egress to match the source — the country that makes it look like a natural visitor to that site, which also clears geo-fencing and CAPTCHA. Tested during this course: US sources drew us; Russian sources drew ru.

Two logics, optimising against different threats. Source-matching avoids looking anomalous to the source. Non-attribution avoids being traceable to you. Which should win depends on who owns the logs and how large the crowd is: a US egress at a US government site hides among millions; the same egress at a target's own infrastructure does not.

1234

The catalogue, in your hands

Thirty services. Each one is toggleable independently for Browser and for Agent — which means the same question asked two ways can return different answers, and nothing in the interface warns you.

Work the table below rather than reading it.

Delegated, not abdicated

This is the run from page 4, and you are going to approve it one round at a time. Read each proposed call before you advance — that is the whole exercise.

Notice what the gate makes possible: because each round is shown before it executes, you can see the reasoning and disagree with it. A system that simply ran and reported would give you the same findings and no way to challenge how they were reached.

Lab — first task, end to end

Now you drive. Work through these in order and keep your own record as you go.

1. Confirm your active project. Then check Federation settings — a new project does not mean a clean collection posture.
2. Check service enablement for both Browser and Agent. Note the difference.
3. Task the Agent with the selector you are given.
4. At the approval gate, predict what the next round will propose. Write it down before you approve. Then compare.
5. Pick the claim that is least attestable — not the most interesting — and go verify it in the Browser.
6. Find both in Wayback. Confirm the timestamp, the routing type and the country.
7. Answer, in writing: which of these artifacts did I observe, and which was I told?

A worked version of exactly this exists: an Agent inferred a company's jurisdiction from a registration-number format, and fifteen minutes in the Browser turned "an associated individual" into "the person holding signing authority", plus a street address the Agent never surfaced.

1234

Where the limits live

Three controls worth knowing before Day 1, because Day 1 argues ethics and it helps to know where the levers actually are.

• Blocked Domains. Collection boundaries, technically enforced. This is where an organisation writes down "we do not collect here". Ethics that cannot be configured are ethics that will not be followed.
• Automatic Screenshots. Whether a custody record gets made at all. Off means no record.
• API keys. The programmatic surface — Day 3's subject.

Where you should be by now

You should be able to say, without looking anything up:

• What work belongs on each of the five surfaces
• Why the Browser exists, in one sentence, without using the word "manual"
• The three decisions a session makes you take before you can look
• Which capture type carries a qualified timestamp, and which does not
• What you would record after a search that returned nothing

Days 1 to 3 teach the doctrine this tool serves. You now know the instrument well enough that those days can be about the work rather than the buttons.