Overview#
Running a serious intelligence operation means maintaining dozens of provider accounts, each with its own authentication scheme, query format, rate limits, and response structure. Analysts waste time on plumbing that has nothing to do with the investigation. Provider Orchestration eliminates that overhead. A single unified interface sits in front of 80+ OSINT providers, handles credentials, normalises responses, and fires queries in parallel. The analyst asks a question; the platform handles everything behind it.
The platform supports intelligent query routing, parallel execution, and automated result aggregation across blockchain intelligence, identity verification, threat intelligence, dark web monitoring, domain analysis, and social media intelligence providers. In total, the Argus ecosystem connects to 153 third-party integrations, all accessible through this layer.
Key Features#
- Unified Query Interface: Single interface to 80+ OSINT providers with automated query translation, response normalisation, and consistent data schemas across all provider categories
- Multi-Provider Query Routing: Intelligent provider selection based on query type, data coverage, cost optimisation, and performance characteristics to maximise result quality
- Parallel Execution: Concurrent queries across multiple providers with sub-second aggregation, automatic timeout handling, and fallback chains for provider failures
- Provider Health Monitoring: Real-time monitoring of provider availability, response times, error rates, and data quality with automatic failover and degraded mode handling
- Cost Management: Per-query cost tracking, budget controls, usage analytics, and provider selection optimisation to manage OSINT spending across the organisation
- Credential Management: Secure storage and rotation of provider API credentials with tenant-level isolation and access controls
- Result Deduplication: Automated identification and merging of duplicate results across providers, reducing analyst noise and improving data quality
- Custom Provider Integration: Extensible framework for adding new OSINT providers with standardised connector development and testing tools
Use Cases#
- Comprehensive Investigation: Execute investigation queries across all relevant providers simultaneously, receiving unified results without managing individual provider accounts or interfaces
- Provider Evaluation: Compare results across multiple providers for the same query to assess coverage, accuracy, and cost-effectiveness for procurement decisions
- Operational Efficiency: Eliminate the overhead of maintaining individual provider integrations, credentials, and query formats across the organisation
- Scalable Intelligence Operations: Support growing OSINT requirements by adding new providers without workflow changes or analyst retraining
- Budget Optimisation: Track and optimise OSINT spending across providers with usage analytics, cost-per-query metrics, and intelligent routing to cost-effective sources
Integration#
The platform serves as the provider abstraction layer for the entire Argus OSINT ecosystem. Individual OSINT modules route queries through the orchestration layer for provider management, while investigation and profile management modules consume aggregated results for case-linked intelligence. Supported integrations include Shodan, SpiderFoot, Maltego, Maltego CE, Cortex (TheHive), OpenCTI, and MISP among the 153 total third-party providers. Results export via STIX/TAXII for external sharing and connect to all Argus OSINT domain modules including threat intelligence, dark web monitoring, domain analysis, and person intelligence.
Open Standards#
- STIX 2.1 (OASIS CTI TC): The orchestration layer ingests, validates, and exports threat intelligence using Structured Threat Information Expression 2.1 bundles and Structured Data Objects, with the stix2 library used for full spec validation where available.
- TAXII 2.1 (OASIS CTI TC): An async polling client implements the Trusted Automated eXchange of Intelligence Information 2.1 protocol, enabling analyst-configured feed subscriptions that pull indicator collections from remote TAXII servers on demand.
- MISP REST API v2.4: The platform integrates directly with the MISP open-source threat intelligence sharing platform via its versioned REST API, synchronising events and attributes into the normalised indicator store.
- MITRE ATT&CK: Attack-pattern profiles store MITRE ATT&CK technique identifiers (e.g. T1003), allowing threat intelligence results surfaced from providers such as VirusTotal to be tagged and queried by ATT&CK technique.
- GraphQL (June 2018 specification): All provider management, health monitoring, query execution, and result retrieval operations are exposed through a typed GraphQL API built with Strawberry, giving clients a strongly-typed query interface across the full provider catalogue.
- OAuth 2.0 (RFC 6749) / Bearer Token (RFC 6750): The provider execution framework supports oauth2 and bearer authentication schemes via the standard HTTP Authorization header, alongside api_key and HTTP Basic, to accommodate the credential patterns of external OSINT provider APIs.
- AES-256-GCM (NIST SP 800-38D): Provider API credentials are encrypted at rest using AES-256-GCM authenticated encryption before being persisted in the database, ensuring confidentiality and integrity of all tenant-scoped secrets.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14