Aperture — OSINT Workbench

Local-first OSINT workbench for SOC/DFIR: IoC pivot, playbooks, cases. No API keys by default. Formerly SOC OSINT Search.

Aperture is a local-first OSINT browser extension for SOC, DFIR, and threat intelligence analysts. Paste or select an indicator of compromise — such as an IP, domain, URL, email, hash, or CVE — and open public OSINT lookup sites in new tabs. Built as an investigation workbench: • Popup launcher — classify indicators locally, then run tools or playbooks • Dashboard — triage inbox, bulk extract, cases, playbooks, relationship graph, offline packs • Playbooks — multi-tool workflows in one click (shareable APX codes) • Cases — verdicts, tags, notes, timeline, and JSON / Markdown / CSV export • On-page detect (opt-in) — highlight IoCs and open a pivot card • Context menu and command palette for fast lookup Core use requires no API keys, no accounts, and no telemetry. Parsing stays on-device; network use is limited to the public OSINT tabs you choose to open. Optional Labs features (local LLM / API enrichment) are off by default. Formerly published as SOC OSINT Search.