Data Points

🖼️ Image / Photograph

A still image — carries EXIF metadata and is the primary artifact for visual verification.

Media

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

—

native tool

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — Image / Photograph exploitation

Direction — frame the requirement for Image / Photograph: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Image / Photograph

An image is a photograph or still frame carrying visual content plus embedded metadata (EXIF), used as evidence in geolocation, identity and provenance work. It matters for verifying claims, geolocating events, detecting manipulation/deepfakes and linking media to devices, places and people.

Format: Raster file (JPEG/PNG/HEIC/WEBP/TIFF) with optional EXIF/IPTC/XMP metadata; integrity referenced by md5/sha1/sha256 hash and perceptual hash (pHash/aHash/dHash).

📡 How it is collected

Social media and messaging uploads
Device camera capture (with EXIF)
Web scraping / image search
CCTV / bodycam frame grabs
Leaked datasets and archives
Satellite / aerial imagery

📚 Enrichment & validation sources

ExifTool / metadata viewers →Google/Yandex/Bing reverse image search →TinEye →InVID/WeVerify →FotoForensics (ELA) →PimEyes (face) →SunCalc (shadow geolocation) →Overpass Turbo / OpenStreetMap →

🔗 Pivot to

capture device (make/model, serial) →GPS coordinates / location →dp_hash (file hash) →depicted people / faces →source URL / account →linked social media handle →

🧩 Analysis & hunting techniques

EXIF/XMP metadata extraction and consistency check
Reverse image search for earliest/other occurrences
Error-level analysis and splice/manipulation detection
Shadow/sun-angle geolocation (chronolocation)
Landmark and signage OCR geolocation
Perceptual-hash near-duplicate clustering
Deepfake/GAN-artifact detection
Camera-fingerprint (PRNU) attribution

🔧 Tools

ExifTool
InVID/WeVerify
FotoForensics
TinEye
Yandex Images
SunCalc
Overpass Turbo
Maltego

⚡ Workbench actions

Extract EXIF/XMP metadata
Run reverse image search
Compute file & perceptual hashes
Perform ELA / manipulation check
Geolocate via shadows/landmarks
Cluster near-duplicates by pHash
Screen for deepfake artifacts
Pivot to source account/URL

📊 Dashboard KPIs

EXIF metadata present (%)Reverse-search matches foundManipulation-likelihood scoreGeolocation confidenceNear-duplicate cluster size

📂 Open

Image profile →Hash profile →Socmint →OSINT →Link analysis →Correlate →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook