OSINT Jet · Investigation planning
How to Write an OSINT Investigation Brief That Gets a Useful Answer
“Find everything about this company” sounds thorough but gives an investigator no finish line. A short OSINT request can be much more useful: say what decision you face, which public clues you already have, what is off-limits and what evidence would change your mind.
Start with the decision, not the search box
Suppose a supplier sends a new domain and asks your team to move a conversation there. Your decision is whether to use that domain for the next step. “Investigate the supplier” is too broad. “Does the public evidence connect this new domain to the supplier’s known official domain as of this week?” is a question someone can investigate and answer with limits.
The Berkeley Protocol’s investigation-plan template includes objectives, scope, risks, roles and documentation for its human-rights context. A buyer of an ordinary OSINT report does not need to copy that whole framework. The transferable principle is to define the question and boundaries before collecting more material.
If you are doing the work yourself, the investigation checklist covers the research sequence. This article is about the request you hand to a person or service before that sequence begins.
The seven fields of a one-page OSINT request
| Field | Write this | Avoid this |
|---|---|---|
| Decision | “Can we treat the new domain as an authorized supplier channel?” | “Tell us everything about them.” |
| Starting clue | Exact public URL or organization name, and why it is relevant | A loose name with no context |
| Time window | What period matters and when the decision is due | An unlimited historical search |
| Allowed scope | Public company pages, domain records and named official accounts | Implied access to private systems |
| Exclusions | Private individuals, leaked credentials or unnecessary personal data | Silence about boundaries |
| Deliverable | Finding, source links, dates, competing explanation and open questions | A screenshot pile or unexplained score |
| Stop rule | End after the decision is supported, contradicted or remains unresolved | “Keep looking until you prove it.” |
Copy the fields, not the example. Your purpose may be a publication check, a company background question, an image claim or a possible impersonation. In each case the request should be narrow enough that a reviewer can tell whether the answer actually fits the question.
A fictional brief you can adapt
orders@northquay-update.example says future quotations will use a different website. The buyer has no independent confirmation from the supplier’s known channel.Decision: Should our team use the new domain to exchange a quotation? Starting clues: the new public domain, the known official domain and the exact message as received; do not share unnecessary personal details. Time window: public evidence relevant to the current domain change, with a decision needed before next week’s meeting.
Allowed checks: public website claims, available domain history and public organization channels. Excluded: private account access, contact with unrelated employees and any attempt to obtain credentials. Deliverable: a short source-linked comparison, observation dates, alternative explanations and a clear “not established” if the domain connection remains uncertain. Stop rule: if public material cannot establish authorization, ask the buyer to verify through a previously known official channel.
This brief does not ask an investigator to confirm payment details or guarantee the sender’s identity. A company may own a domain yet the specific message may still be unauthorized. The company OSINT guide explains entity research; the brief determines which entity question matters here.
Make the answer reviewable before work begins
Agree on the output language, deadline and whether a concise answer or a fuller evidence appendix is needed. Ask the researcher to separate observed public facts, interpretation and what remains unknown. A result that says “no public link found” should not silently become “no link exists.”
The ODNI analytic standards require its own intelligence analysts to distinguish source information, assumptions and judgments and explain material uncertainty. Your commercial brief does not inherit those institutional rules, but it benefits from asking for the same clarity. The OSINT report template shows how a finished answer can record sources and limitations; this page prepares the input.
Protect the scope when the lead feels urgent
Urgency is a reason to write a better stop rule, not to remove it. An investigation of a business domain can drift into researching staff, family members or leaked material that has no bearing on your decision. State what you are authorized to examine, why each clue is necessary and how the result will be used. If a private person’s data would be involved, seek appropriate advice for your context before collection.
Do not phrase the desired outcome as “prove this is fraud” or “clear this company.” Ask the researcher to test the connection and report both confirming and contradicting signals. If the evidence is thin, an unresolved answer is useful: it tells the decision-maker to use a separate verification channel.
Use the brief to choose the right amount of help
Some questions can be answered with your own notes and the free tools guide. If the case crosses several public clues or the result needs a traceable report, OSINT Jet offers a structured investigation path and a separate manual investigation option. Check the current service terms before ordering. Bring the seven fields above so the work starts with your actual decision.
The best request is not the longest. It is the one that lets a reader point to the answer, its public support and the precise point where the evidence stops.
Published by OSINT Jet · Original publication: 29 September 2026