Digital intelligence glossary.

Collection and analysis of open or lawfully accessible information to answer a defined question.

Caution: Technical accessibility alone does not make every collection lawful or proportionate.

The people, entities, periods, countries, sources and questions covered by research.

Caution: Overly broad scope increases noise, unnecessary data and error risk.

An identifier used to move from a verified item to another source, such as a domain, alias or official number.

Caution: A shared pivot does not prove that two items belong to the same person.

Confirmation of a fact through genuinely independent, dated evidence suited to the question.

Caution: Multiple repetitions of one claim still represent one original source.

Material produced directly by the actor, system or institution connected with the fact under review.

Caution: It strongly establishes the statement or record, not necessarily its complete truth.

Analysis, synthesis or reporting based on primary sources or other publications.

Caution: Return to cited references before relying on a material claim.

The degree to which an item relies on collection, testimony or method separate from other sources.

Caution: Different publishers may depend on the same wire report or press release.

Documented origin of an item and the chain showing how it was obtained or transformed.

Caution: Incomplete provenance limits claims that can be made about authenticity.

Reasoned connection between an action, content or asset and a person, entity or group.

Caution: A technical or stylistic coincidence is generally insufficient.

A person or entity sharing an identical or similar name with the subject under review.

Caution: Always confirm several identifiers before attributing information.

A trading name, pseudonym or alternative identifier associated with a person or entity.

Caution: The same alias is often used by more than one person.

Deceptive use of another party’s identity, image or distinctive signs on a digital service.

Caution: Separate public copying, a fake profile and compromise of the legitimate account.

Human-readable identifier associated with internet services and organised into dot-separated labels.

Caution: In a URL, identify the registered domain before interpreting subdomains.

A label before the registered domain, used to organise services or create a misleading appearance.

Caution: A brand name in a subdomain does not mean that brand controls the site.

Registration of a domain resembling a known name through a typo, addition or character substitution.

Caution: Similarity is a signal requiring context, not automatic proof of fraud.

A certificate used to establish an encrypted connection and identify the covered domain.

Caution: It guarantees neither site honesty nor the claimed business identity.

A file, message, log, page or trace capable of supporting a fact when preserved with context.

Caution: Its value depends on origin, integrity and the question being asked.

A value calculated from a file to detect later changes to its content.

Caution: A hash proves neither author, original date nor truth of the file.

Information describing a file or content, such as format, dates, device, declared author or processing.

Caution: Metadata can be absent, altered, removed or created by software.

Record of people, copies, transfers and transformations applied to a preserved item.

Caution: Legal requirements vary; obtain suitable advice where proceedings are contemplated.

Observable assets, information and people that may be used to understand or target an organisation.

Caution: Visible information is not automatically an exploitable vulnerability.

An incomplete or isolated item that warrants checking but does not yet support a conclusion.

Caution: Accumulating dependent signals does not replace independent confirmation.

Reasoned assessment of how strongly a conclusion is supported given sources and unknowns.

Caution: It is not a universal percentage of truth.

A plausible chain connecting a signal, adverse action, affected asset and consequence.

Caution: A scenario supports prioritisation but does not automatically predict an event.

An interpretive frame connecting facts, symbols and claims into a coherent reading of a situation.

Caution: Repetition of a narrative proves neither coordination nor truth.

Increased content visibility through reposting, recommendation, advertising or coordinated or spontaneous activity.

Caution: High visibility does not necessarily mean broad agreement.

Common organisation of actions, messages or timing among several actors or accounts.

Caution: Timing and similarity alone may have other explanations.

Movement of a claim through several relays until its weak or interested origin becomes obscured.

Caution: Return to the earliest observable version and identify dependencies.

Immediate measures limiting access, spread or impact before complete remediation.

Caution: Preserve useful evidence before irreversible deletion where appropriate.

Correction of the cause and conditions that enabled an incident or exposure.

Caution: Visible removal does not prove the cause, copies or access have disappeared.

Structured transfer of a case to the level, team or authority able to act.

Caution: State facts, urgency, impact, completed actions and required decision.

Post-action review that preserves learning, improves controls and clarifies responsibilities.

Caution: Assess the process without turning the exercise into individual blame.