Continuous Exposure Monitoring
Turns one-shot external recon into a continuous monitoring program.
Install
npx skills add elementalsouls/Claude-OSINT --skill continuous-exposure-monitoring -g -a claude-code -y- Repository
- elementalsouls/Claude-OSINT2.9k
- Category
- Security
- Updated
- 15d ago
- License
- MIT
- Context cost
- Mediumabout 3,000 tokens
- Runs scripts
- No, instructions only
What it does
Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. P
Continuous Exposure Monitoring, Loop, Diff, Chatter, Lifecycle
Companion skills:
osint-methodology(the 5-stage pipeline this skill loops, see its §7.2 "ongoing weekly diff" profile, which this skill fills in with concrete mechanics),offensive-osint(§29 Threat Intel & IOCs, this skill deepens that section's advisory/IOC-feed directory with the continuous adversary-chatter watch loop and CTI-feed cadence it explicitly lacks; use §29 for indicator enrichment and vulnerability-prioritization data sources, this skill for the standing collection loop),org-attack-surface(the org-first discovery this skill's re-scans re-run on a schedule),exposure-risk-quantification(reads this skill's finding-lifecycle suppression state to computerisk_trendand the FAIR score, see its risk-score model). This skill answers a different question than all four: not "what does the target expose right now," but "is what the target exposes changing, and should anyone be told."
0. When to Use / When NOT
Use this skill when:
