salvacybersec/personas
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(bellingcat): expand open-source-research-notebooks deep-dive

Browse Source 
Replace single-line entry in references/bellingcat-own-repos.md with
dedicated subsection for the Bellingcat open-source-research-notebooks
repo (298★, MIT, last updated 2026-04-28).

Adds:
- Full notebook catalog: 6 Bellingcat-developed + 7 community + 1 intro
- Direct Colab links for every notebook (no install friction — analyst
  runs in 30s)
- Difficulty level (easy/medium) per notebook
- Persona affinity per notebook (oracle/wraith/frodo/scribe/marshal/
  centurion/herald/specter mapped per use case)
- "When to reach for which notebook" decision table mapping
  investigation triggers (lead is a phone / email / username / face /
  shadow / Russian VK / video etc.) to the right notebook
- "Why this is the highest-leverage Bellingcat repo" rationale: zero
  install, form-driven inputs, reproducibility-first, maintained, MIT

Stays within bellingcat-osint-toolkit skill — no fragmentation.
References file: 374 → 443 lines.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
salvacybersec
2026-05-02 02:19:14 +03:00
parent 700122807d
commit 1161e69f51
1 changed files with 72 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
personas/_shared/community-skills/bellingcat-osint-toolkit/references/bellingcat-own-repos.md
View File

@@ -272,7 +272,7 @@ trackers — fork + adapt.
| Repo | ★ | Lang | Use | Personas |
| --------------------------------- | --- | ---------------- | ---------------------------------------------------------------- | -------------------- |
| `RS4OSINT` | 45 | TeX | Guide to Remote Sensing for OSINT (PDF + LaTeX source) | oracle, marshal, scholar |
| `open-source-research-notebooks` | 298 | Jupyter Notebook | Tutorial notebooks for command-line + code OSINT investigations | scholar, oracle |
| `open-source-research-notebooks` | 298 | Jupyter Notebook | 14 ready-to-run notebooks (see deep dive below) | scholar, oracle, all-OSINT |
| `open-questions` | 360 | Jupyter Notebook | Difficult research projects waiting for contributors | scholar, all-osint |
| `o9a-product-scripts` | 8 | Python | Scripts from Order of Nine Angles investigation | wraith (HUMINT) |
| `quitobaquito` | 14 | Python | Hydrology change methodology with GEE | scholar, oracle |
@@ -281,8 +281,77 @@ trackers — fork + adapt.
| `who-killed-abelardo` | 4 | (web) | Audio map visualization (single-investigation viz) | wraith, herald |
| `avoc` | 59 | CSS | 2024 Tech Fellowship working repo | (browse before reach)|
`open-source-research-notebooks` is the best entry point for a researcher
new to Bellingcat methodology — it teaches the toolkit-via-Jupyter workflow.
### `open-source-research-notebooks` — full notebook catalog
The single best entry point for an analyst new to OSINT-via-code. **MIT
licensed**, **last updated 2026-04-28** (active). Each notebook runs in 4
environments: **Colab** (no install), **Binder**, **Kaggle Notebooks**, or
local Jupyter. Every notebook has guided form-style parameter inputs —
zero code-writing required for the easy ones.
Repo: <https://github.com/bellingcat/open-source-research-notebooks>.
Methodology guide: <https://www.bellingcat.com/resources/2024/03/06/how-code-notebooks-enable-open-source-research/>.
#### Bellingcat-developed notebooks (6)
| Notebook | Lvl | Run | What it does | Persona fit |
| -------- | --- | --- | ------------ | ----------- |
| **telegram-phone-number-checker** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/bellingcat/telegram-phone-number-checker.ipynb) | Phone number → bound Telegram account check. Single + batch inputs. | oracle, wraith, frodo |
| **wayback-google-analytics** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/bellingcat/wayback-google-analytics.ipynb) | Pull historic GA tag IDs from Wayback Machine — cross-link sister sites that share an analytics ID, even after current page strips it. | sentinel, oracle |
| **geoclustering** | medium | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/bellingcat/geoclustering.ipynb) | Cluster a CSV of (lat,lon) incidents. Bundled `civharm.csv` Ukraine sample. | oracle, frodo, marshal, centurion |
| **vk-url-scraper** | medium | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/bellingcat/vk-url-scraper.ipynb) | Scrape VKontakte URLs → metadata + media files. | oracle, ghost, frodo |
| **search-grid-generator** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/bellingcat/search-grid-generator.ipynb) | Generate a KML grid for systematic AOI satellite-image search. | oracle, marshal, centurion |
| **shadow-chronolocator** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/bellingcat/shadow-chronolocator.ipynb) | **Single-cell parametric form**: known location + sun-elevation/azimuth range + date → returns possible matching times. | oracle, frodo, centurion |
#### Community-contributed notebooks (7)
| Notebook | Lvl | Run | What it does | Persona fit |
| -------- | --- | --- | ------------ | ----------- |
| **whisper** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/whisper.ipynb) | OpenAI Whisper audio/video transcription + translation in-notebook. | scribe, herald, oracle |
| **holehe** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/holehe.ipynb) | Email → list of bound web accounts. Single + batch + CSV export (17 cells, well-documented). | wraith, oracle |
| **maigret** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/maigret.ipynb) | Username → list of bound accounts across 500+ sites (Sherlock alternative, more sources). | wraith, oracle |
| **wayback-machine-downloader** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/wayback-machine-downloader.ipynb) | Bulk-download a whole site's Wayback snapshot at a chosen date. | scribe, oracle |
| **yt_dlp** | easy | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/yt_dlp.ipynb) | Download videos from 1000+ platforms; includes advanced post-processing (subtitle merge, audio-only, geo-bypass). | scribe, herald, oracle |
| **exiftool** | medium | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/exiftool.ipynb) | Read + analyze every metadata tag in image/video/PDF — GPS, camera serial, edit-history. | specter, oracle, scribe |
| **deepface** | medium | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/community/deepface.ipynb) | AI face comparison + demographic analysis — verify whether two photos depict the same person. | wraith, oracle |
#### Methodology
| Notebook | Run | What it does |
| -------- | --- | ------------ |
| **intro-to-notebooks** | [Colab](https://colab.research.google.com/github/bellingcat/open-source-research-notebooks/blob/main/notebooks/methods/intro-to-notebooks.ipynb) | 5-minute Jupyter/Colab intro — zero-prerequisite onboarding for an analyst who has never touched a notebook. |
#### When to reach for which notebook
| Investigation moment | Notebook |
| ----------------------------------------------------------------- | ----------------------------------- |
| Lead is a phone number | telegram-phone-number-checker |
| Lead is an email | holehe |
| Lead is a username | maigret |
| Lead is a face / person ID match needed | deepface |
| Lead is a photo with a sharp shadow | shadow-chronolocator |
| You need to identify hidden ownership across multiple websites | wayback-google-analytics |
| You need to pull a whole site's history (page-by-page) | wayback-machine-downloader |
| You need video / audio in a different language | whisper |
| You need to bulk-download videos before takedown | yt_dlp |
| You have an image and want every metadata field | exiftool |
| You have a CSV of incidents and need to find clusters | geoclustering |
| You're scanning satellite imagery over a large AOI | search-grid-generator |
| You're investigating Russian VK posts/photos | vk-url-scraper |
| Onboarding a colleague to OSINT-via-code | intro-to-notebooks |
#### Why this is the highest-leverage Bellingcat repo
- **Zero-install friction.** Colab/Binder/Kaggle means an analyst with no
Python setup runs a research-grade tool in 30 seconds.
- **Form-driven inputs.** Most easy-tier notebooks use Colab's
`@param`/`@title` form syntax — you change a value in a UI box, click
Run, get an answer. No code reading required.
- **Reproducibility-first.** Every notebook = methodology + tool + sample
data. Lift the methodology into your own write-up, swap the data,
republish.
- **Maintained.** Last commit 2026-04-28; not a graveyard.
- **MIT.** Fork, adapt, rebrand for your team's internal toolkit.
## Council / government records