Tools, Automation, and Reporting

PORP · 50 questions

• A 311 desk receives a dumped-mattress photograph with no address on the ticket. A clerk opens a username-hunter first. Which tool class should the analyst use for the location problem?
• Procurement has only a bidder email address on a bid packet and no website or photograph. Which tool class should the analyst open first?
• Parks leadership bookmarks an OSINT Framework-style index and treats that page as a finished investigation of a concession vendor. How should the analyst treat the site?
• Library IT bookmarks twenty trial people-finder SaaS products to research one public handle from the staff directory. What should the analyst do instead of tool sprawl?
• Code enforcement has only a public username from a complaint post and no domain name. Which tool class is the right first pivot?
• A 311 callback field contains only a phone number and no social handle. Which tool class should the analyst use first?
• The public information office reports a fake social account impersonating the fire department. Which tool class should the analyst open first?
• Open-data staff treat an OSINT framework link directory as the case-management system for a vendor review. Where should findings actually be stored?
• A vendor tells the clerk that a paid people-search SKU is the only real OSINT for a permit applicant. How should the analyst proceed?
• GIS wants an all-in-one link-analysis graph populated before any URL or screenshot is captured on a parcel dispute. What is the correct use of that tool class?
• Two breach-lookup tools disagree on whether a procurement email appears in a public exposure corpus. What belongs in the report?
• Historic preservation installs a browser extension that phones home with every civic URL visited during research. What OPSEC choice should the analyst make?
• An OSINT framework tree lists a dark-web market scraper beside search and image tools. Which families stay in-scope for PORP-style civic work?
• Transit has a bus-stop photograph that also needs map correlation to confirm the shelter. How should the analyst choose tools?
• The clerk asks which OSINT tool proves a Facebook post about a washout is authentic. What should the analyst say?
• Occupancy licensing profiles a contractor website and learns the CMS type. Staff want to treat that output as a vulnerability to attack. How should the analyst treat it?
• A new intern runs only one favorite username tool and skips phone and email pivots even though those identifiers are on the complaint. What methodology should the analyst apply?
• Open-data staff want a script that requests a vendor website every second to automate website OSINT. What judgment should the analyst apply?
• A bulk WHOIS script returns 200 rows and an analyst pastes them unreviewed into a council packet. What should happen first?
• Parks wants a job that screenshots every Instagram hashtag matching the city name, forever. What is the PORP-aligned automation pattern?
• Website OSINT automation can pull public sitemaps and archive captures for five named vendor domains. How does that job differ from a citywide crawl of all residents?
• Housing staff want a scripted browser to log into a sock puppet and send friend requests to fifty landlords. What should the analyst do?
• The library research VM stores lookup-service API keys in a public gist for convenience. What should the analyst do with those secrets?
• Stormwater automation saved HTML from a contractor page that later changed. What is the saved copy for?
• A regex email finder run on a city PDF harvests strings from image timestamps that look like addresses. What should the analyst do before the report?
• A county grants office wants an analyst to paste a vendor URL list into a generative model and ship whatever it writes as the OSINT report, with no screenshots or source captures. What should the analyst do?
• Public works schedules a nightly automated crawl of a paving contractor's website, including paths the site's robots.txt already lists as disallowed. What is the professional OSINT choice?
• A housing-authority team automates screenshot jobs for vendor pages, but the captures crop out the address bar and show no retrieval time. What evidence standard should the analyst enforce?
• An intern launches a highly parallelized lookup tool against a city vendor's public site. The vendor's web application firewall fires, and the vendor calls the mayor's office about an apparent attack. What should the analyst have done?
• A library consortium due-diligence task has five vendor URLs and matching archive links. A junior analyst insists on writing a crawler before collecting anything. What is the right call?
• During a parks vendor-background drill, the same unusual tagline appears on a company website, a public resume, and a social-media bio. What method should the analyst use?
• A rumor about a closed rec-center pool is spreading on neighborhood forums. Staff want to open every OSINT tool they have before writing down what the city actually needs to know. What workflow should the analyst require?
• After an overnight collection job, an intern drops a raw JSON export on the housing director's desk and calls it the OSINT briefing. What should the analyst do instead?
• A county procurement OSINT packet on a paving vendor is due Monday morning. The analyst spends the weekend in one social-media rabbit hole and never drafts the report. What time-management practice was required?
• Parks leadership asks for an OSINT memo that lists conclusions only and skips the methods so it stays short. What should the analyst include?
• A water-utility rumor report includes a stack of screenshots with no captions and no pointers from claims to images. What reporting standard should the analyst apply?
• The city clerk wants a vendor-research report written as one long story instead of answering each assigned question. What structure should the analyst use?
• A draft county vendor report says the contractor is obviously lying, but it cites no public record that contradicts the contractor's statement. What language standard should the analyst enforce?
• Two days after a permitting OSINT memo ships, several cited vendor URLs return 404. What citation practice should have been in the report?
• The public-information officer asks to strip every username from a report about a public account impersonating the city library. What identifier practice should the analyst follow?
• A time-boxed city clerk OSINT packet has six questions of mixed difficulty. An intern starts the hardest identity puzzle and ignores the rest. What engagement sequence should the analyst use?
• A transit due-diligence plan reserved a final review hour, but staff skip it and ship a report that names the same vendor three different ways and mislabels screenshots. What should have happened?
• During a live, time-boxed civic OSINT drill, staff start posting the assigned questions into a public Discord server to crowdsource hints. What is the professional rule?
• An intern copies a blank penetration-test template with exploit narrative, proof-of-concept, and CVSS sections for a parks vendor OSINT memo. What should the analyst use instead?
• A stormwater OSINT finding is footnoted only as Google. What citation should the analyst require?
• Two county analysts reach opposite conclusions about whether a vendor's public officer list matches a bid packet, each citing different sourced pages. What should the professional report do?
• Emergency management asks that a washout-rumor OSINT product be just a tweet, with no methods or evidence attached. What should the analyst deliver?
• Screenshots in a port-authority vendor report show the analyst's personal bookmarks bar, a logged-in mail icon, and hobby folders. What evidence-hygiene step is required?
• A procurement due-diligence OSINT memo describes conclusions but never lists the search operators, reverse-image checks, web-archive captures, or secretary-of-state filings that produced them. What should the analyst add?
• At the civic OSINT deadline, three assigned questions have sourced evidence and two are still thin. Staff want to miss the cutoff chasing one more clue. What should the analyst do?