OSINT Daily Brief
Automated open-source intelligence report for any target.
Pulls from Tavily AI search, DNS records, WHOIS, and optionally Shodan.
Structures findings into a daily brief you can read in under 2 minutes.
Use for: competitive intel, brand monitoring, pre-engagement recon, daily threat feeds.
Prerequisites
# Required
TAVILY_API_KEY=your_key_here # tavily.com → free: 1,000 searches/month
# Optional — for richer results
SHODAN_API_KEY=your_key_here # shodan.io → free tier available
Workflow
1. Web intelligence (Tavily)
import os, requests
def tavily_search(query: str, max_results: int = 5) -> list[dict]:
"""AI-optimized web search — returns full page content, not just snippets."""
r = requests.post(
"https://api.tavily.com/search",
json={
"api_key": os.environ["TAVILY_API_KEY"],
"query": query,
"max_results": max_results,
"search_depth": "advanced",
},
timeout=15,
)
return r.json().get("results", [])
# Example: monitor a target
target = "example.com"
news = tavily_search(f"{target} security breach data leak 2026")
tech = tavily_search(f"{target} technology stack infrastructure")
2. DNS recon
import subprocess
def dns_recon(domain: str) -> dict:
results = {}
for record_type in ["A", "MX", "NS", "TXT"]:
try:
r = subprocess.run(
["dig", "+short", record_type, domain],
capture_output=True, text=True, timeout=5
)
results[record_type] = r.stdout.strip().split("\n")
except Exception:
results[record_type] = []
return results
3. WHOIS
def whois_lookup(domain: str) -> str:
try:
r = subprocess.run(
["whois", domain],
capture_output=True, text=True, timeout=10
)
# Extract key fields only
lines = r.stdout.split("\n")
relevant = [l for l in lines if any(k in l.lower() for k in
["registrar", "created", "expires", "registrant", "name server"])]
return "\n".join(relevant[:15])
except Exception as e:
return f"WHOIS error: {e}"
4. Shodan (optional)
def shodan_lookup(ip_or_domain: str) -> dict:
key = os.environ.get("SHODAN_API_KEY")
if not key:
return {"error": "SHODAN_API_KEY not set"}
try:
r = requests.get(
f"https://api.shodan.io/shodan/host/{ip_or_domain}",
params={"key": key},
timeout=10
)
data = r.json()
return {
"ports": data.get("ports", []),
"org": data.get("org", ""),
"country": data.get("country_name", ""),
"vulns": list(data.get("vulns", {}).keys())[:5],
}
except Exception as e:
return {"error": str(e)}
5. Format the brief
OSINT DAILY BRIEF — [target] — YYYY-MM-DD
─────────────────────────────────────────
THREAT INDICATORS
⚠️ [finding] — [source]
✅ No breach mentions in last 30 days
DNS PROFILE
A: [IPs]
MX: [mail servers]
NS: [nameservers]
TXT: [SPF/DKIM/verification records]
WHOIS
Registrar: [name]
Created: [date]
Expires: [date]
Name Servers: [list]
EXPOSED ASSETS (Shodan)
Open ports: [list]
Org: [org name]
CVEs: [list or "none detected"]
NEWS & WEB MENTIONS (last 30 days)
1. [title] — [source] — [url]
2. ...
SUMMARY
Risk level: [LOW/MEDIUM/HIGH]
Key concern: [one sentence]
Recommended: [1–2 actions]
─────────────────────────────────────────
Sources: Tavily, WHOIS, DNS, Shodan
Scheduling — daily brand/target monitoring
# Monitor your own domain daily
openclaw cron add \
--name "osint-brief:daily-self" \
--cron "0 6 * * *" \
--prompt "Run osint-daily-brief skill on target: yourdomain.com. Send report to Telegram."
# Monitor a competitor
openclaw cron add \
--name "osint-brief:daily-competitor" \
--cron "0 6 * * *" \
--prompt "Run osint-daily-brief skill on target: competitor.com. Flag any new exposed ports, CVEs, or breach mentions."
Use cases
| Use case | Target | Frequency |
|---|
| Brand monitoring | your domain | daily |
| Competitive intel | competitor domains | weekly |
| Pre-engagement recon | client domain | one-time |
| Threat actor tracking | IP ranges | daily |
| Dark web mentions | brand keywords | weekly |
Privacy & ethics
- Only investigate targets you own or have explicit authorization to research
- All data comes from public sources (Tavily, DNS, WHOIS, Shodan)
- No social engineering, credential testing, or active probing
- WHOIS and Shodan data is public by design — this skill reads it, does not generate it
- Comply with applicable laws in your jurisdiction
Notes
- Tavily free tier: 1,000 searches/month. Each run uses ~3–5 searches.
- Shodan free tier: limited to 1 result per query on some endpoints
- DNS recon requires
dig installed: sudo apt install dnsutils
- WHOIS requires
whois installed: sudo apt install whois
- For dark web mentions, pair with Tor proxy (Ahmia search via SOCKS5)
