# Continuous Exposure Monitoring

Turns one-shot external recon into a continuous monitoring program.

- Repository: https://github.com/elementalsouls/Claude-OSINT (2943 stars)
- Category: Security
- License: MIT
- Last updated: 2026-10-20
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add elementalsouls/Claude-OSINT --skill continuous-exposure-monitoring -g -a claude-code -y`
Codex: `npx skills add elementalsouls/Claude-OSINT --skill continuous-exposure-monitoring -g -a codex -y`
Cursor: `npx skills add elementalsouls/Claude-OSINT --skill continuous-exposure-monitoring -g -a cursor -y`
Gemini CLI: `npx skills add elementalsouls/Claude-OSINT --skill continuous-exposure-monitoring -g -a gemini-cli -y`

## Description

Turns one-shot external recon into a continuous monitoring program. Covers the scheduled re-scan-and-diff loop (baseline snapshot -> interval sleep -> re-scan -> asset/finding delta -> threshold-gated webhook alert), the scan-to-scan diff engine (new/removed/changed assets by a tracked-attribute table, new/resolved findings by a stable cross-scan fingerprint), adversary CTI / chatter monitoring across six public feeds (ransomwatch, ransomware.live, HackerNews Algolia search, Reddit security-subreddit RSS, GitHub Gist code-search, public Telegram channel scraping) with a source-kind-aware severity engine (leak-site/forum/telegram/paste tiers, CRITICAL through INFO), literal/glob/regex watchlist pattern matching, full-corpus capture with retroactive rescan on new watchlist entries, infrastructure-tracking-over-time discipline (certificate-transparency, passive-DNS, port/service, and typosquat re-enumeration cadence, and what a genuine 'perimeter drift' event looks like in the diff output), a five-state finding-lifecycle state machine (open/triaged/risk_accepted/resolved/false_positive) with per-severity SLA and fingerprint-based cross-scan dedup and auto-resolve/reopen rules, the alert-fatigue trap where a lifecycle-unaware rule re-fires on an already-accepted finding, a durable retry/backoff alert-outbox pattern ('queued is not delivered'), and copy-paste bash-cron plus PowerShell-Scheduled-Task recipes for a re-scan+diff loop with the Slack-compatible webhook payload shape. P

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Continuous Exposure Monitoring, Loop, Diff, Chatter, Lifecycle

> Companion skills: [`osint-methodology`](../osint-methodology/) (the 5-stage pipeline this skill
> loops, see its §7.2 "ongoing weekly diff" profile, which this skill fills in with concrete
> mechanics), [`offensive-osint`](../offensive-osint/) (§29 Threat Intel & IOCs, this skill
> **deepens** that section's advisory/IOC-feed directory with the continuous adversary-chatter
> watch loop and CTI-feed cadence it explicitly lacks; use §29 for indicator enrichment and
> vulnerability-prioritization data sources, this skill for the standing collection loop),
> [`org-attack-surface`](../org-attack-surface/) (the org-first discovery this skill's re-scans
> re-run on a schedule), [`exposure-risk-quantification`](../exposure-risk-quantification/) (reads
> this skill's finding-lifecycle suppression state to compute `risk_trend` and the FAIR score, see
> its risk-score model). This skill answers a different question than all four: not "what does the
> target expose right now," but **"is what the target exposes changing, and should anyone be told."**

## 0. When to Use / When NOT

**Use this skill when:**

The rest: https://github.com/elementalsouls/Claude-OSINT/blob/HEAD/skills/continuous-exposure-monitoring/SKILL.md