Getting started with Cibera OSINT
An overview of how Cibera OSINT is organized. Detailed help is available inside the console.
Organizations and roles
Everything you create belongs to your organization: watchlists, alerts, investigations and notification settings. Owners and administrators manage members and invitations. Analysts can create and update watchlists, alerts and investigations. Viewers have read-only access.
Shared intelligence and sources
Cibera OSINT collects public and licensed intelligence once and shares it with organizations where each provider's licence allows it. Every record shows its provider, the original reference and when Cibera OSINT collected it. Your plan sets how far back you can search.
Watchlists and alerts
Watchlists can contain domains, IP ranges, CVEs, organizations, brands, threat actors and keywords. New records are checked as they are collected. A match creates an alert that keeps the original evidence and the matching terms. Alerts can be acknowledged, dismissed or turned into an investigation.
Telegram notifications
You can connect your own Telegram chat in Settings with a one-time link. Notifications contain only the alert number, source and category, with a link back to Cibera OSINT. They never contain your watchlist terms.
Telegram and dark web sources
Telegram channels and onion pages are monitored only after an operator approves them. Claims found in these sources are marked unverified until independent evidence corroborates them. Attachments are never downloaded.
Plans and limits
Each plan includes limits for users, watchlists, searches, exports, history and notifications. When a limit is reached, Cibera OSINT explains which one and when a periodic quota resets. Your current usage is shown in Settings.