Define Authorized Scope as Data
{
"case_id": "OSINT-2026-014",
"authorized_observables": {
"domains": ["example.org", "example.net"],
"organizations": ["Example Organization"],
"excluded_actions": [
"authentication attempts",
"credential use",
"vulnerability exploitation",
"intrusive scanning"
]
},
"collection_rules": {
"public_sources_only": true,
"preserve_source_url": true,
"preserve_observation_time": true,
"state_confidence": "low | medium | high"
}
}