Aperture - OSINT Workbench wót Peter Stollery

Local-first investigation companion for SOC, DFIR, and CTI analysts.

Pivot on indicators across public OSINT tools, keep cases and history on-device, and run playbooks without accounts, API keys, or telemetry — unless you explicitly enable optional Labs features.

• Popup launcher — paste an indicator, classify locally, run quick tools or playbooks
• Dashboard workbench — triage inbox, bulk extract, cases, playbooks, relationship graph, offline packs, Labs
• On-page detect (opt-in) — highlight IoCs on any page; click for a pivot card with notes, tags, clipboard packs, and related indicators
• Playbooks — ordered multi-tool workflows with optional delay, concurrency, and skip-private-IP
• Cases — group indicators, verdicts, tags, notes, timeline, session capture, JSON/MD/CSV export
• Right-click search — selection → playbooks and OSINT sites
• Keyboard — command palette (⌘/Ctrl+K) plus Ctrl+Shift+K / Ctrl+Shift+O

IPs, domains, URLs, emails, hashes, CVEs, BTC, ASNs — plus ETH, ATT&CK IDs, paths, onion addresses, Telegram/Discord links, and more.


VirusTotal, AbuseIPDB, URLScan, Shodan, Censys, AlienVault OTX, ThreatCrowd, IBM X-Force, MalwareBazaar, GreyNoise, Spur, Have I Been Pwned, crt.sh, RDAP, Wayback Machine, URLhaus, ThreatFox, NVD, BGP HE, MITRE ATT&CK.

• Parsing and enrichment run on-device
• Network use is only when you open OSINT tabs (or enable opt-in Labs adapters/LLM)
• On-page highlights are off by default
• No telemetry by default (Firefox data collection: none)
• No API keys required for core use

• Storage — local history, cases, settings
• Context menus — right-click search
• Tabs / activeTab — open OSINT lookups you choose
• Host access — optional on-page IoC highlights and selection handling

Formerly SOC OSINT Search.