Overview#
Social media is where people are least guarded. Location check-ins reveal travel patterns. Replies to strangers expose associations. Profile photos link accounts across platforms. For investigators at law enforcement agencies, counter-terrorism units, corporate security teams, and brand protection departments, that candor is valuable, but only if you can find and analyse it quickly. Social Media Discovery fires simultaneous searches across 30+ platforms, aggregates what it finds, and surfaces the connections that manual platform-by-platform searching would miss entirely.
The platform extracts profile data, content history, relationship networks, and behavioural patterns while respecting platform-specific access boundaries and ethical collection standards.
Key Features#
- Multi-Platform Discovery: Simultaneous search across 30+ platforms including social networks, messaging apps, content platforms, forums, professional networks, and regional services with confidence-scored results
- Profile Intelligence Extraction: Automated collection of profile data, content history, connection networks, location information, and activity patterns from discovered accounts
- Alias and Account Correlation: Identify alternate accounts and aliases used by the same individual through username patterns, profile photo matching, behavioural analysis, and content correlation
- Sentiment and Content Analysis: Analyse social media content for sentiment, topic classification, threat indicators, and behavioural patterns relevant to investigations
- Network Mapping: Map social connections, group memberships, follower relationships, and interaction patterns to identify associates and communication networks
- Historical Content Recovery: Access cached and archived social media content that may have been deleted from live platforms through web archive integration
- Location Intelligence: Extract geographic information from posts, check-ins, photo metadata, and content context to map subject movements and activity areas
- Monitoring and Alerting: Configure ongoing monitoring of specific profiles or keywords with automated alerting on new posts, profile changes, and activity matching investigation criteria
Use Cases#
- Person of Interest Investigation: Discover all social media accounts for investigation subjects, analyse content for relevant intelligence, and map social networks to identify associates
- Threat Assessment: Monitor social media for threatening language, radicalization indicators, violent imagery, and pre-attack planning signals relevant to public safety
- Missing Person Investigation: Search all platforms for missing person activity, identify recent posts or check-ins, and monitor accounts for new activity indicating contact or location
- Brand and Reputation Monitoring: Track social media mentions of organisations, personnel, or operations with sentiment analysis and threat detection for protective intelligence
- Open-Source Intelligence Collection: Systematically gather publicly available social media intelligence relevant to active investigations with proper documentation and chain of custody
Integration#
The platform integrates with the broader Argus OSINT ecosystem for cross-domain intelligence, digital footprint discovery for comprehensive identity profiling, investigation management for case-linked intelligence, and profile management for entity enrichment. Social media findings connect to person intelligence profiles and to threat intelligence feeds via STIX/TAXII export to OpenCTI and MISP. Works with Maltego and Maltego CE for visual social network mapping and integrates with SpiderFoot for automated follow-on OSINT collection.
Open Standards#
- STIX 2.1 (OASIS CTI TC): Discovered social media profiles, threat indicators, and threat-actor entities are exported as STIX 2.1 bundles for downstream consumption by OpenCTI and MISP.
- TAXII 2.1 (OASIS CTI TC): The platform implements an analyst-configured TAXII 2.1 polling client, allowing social media intelligence findings to be pushed to or pulled from any TAXII 2.1-compliant threat-sharing server.
- OAuth 2.0 (RFC 6749): Third-party social media and OSINT provider APIs that require delegated authorisation are accessed using OAuth 2.0 bearer tokens, alongside API-key and Basic authentication options.
- GraphQL (June 2018 specification): All OSINT collection tasks, provider queries, and discovery results are exposed and consumed through a GraphQL API, enabling precise field-level queries from investigation workflows.
- Internet Archive CDX API: Historical social media content recovery integrates the Internet Archive Wayback Machine CDX search interface to retrieve cached snapshots of deleted or modified posts and profiles.
- IPTC Media Topics (NewsCodes): Content analysis classifies social media posts against the IPTC Media Topic controlled vocabulary, enabling structured subject tagging and cross-source topic correlation.
- JSON (RFC 8259): All provider responses, aggregated social profiles, correlation results, and exported intelligence payloads are serialised as JSON, the interchange format throughout the OSINT pipeline.
Last Reviewed: 2026-02-23 Last Updated: 2026-04-14