OSINTverse
Sign in

Course

SANS SEC497: Practical Open-Source Intelligence

Matt Edmondson, SANS Institute

Open the course pageAll courses

The six-day course and GIAC certification most often named in job listings. Excellent and expensive; worth it when an employer pays, not a prerequisite for the work.

SEC497 is SANS's foundational OSINT course and the one the GIAC Open Source Intelligence certification is tied to. Six sections cover OPSEC, essential skills, investigating people, websites and infrastructure, automation and the dark web, and a capstone capture-the-flag, with 29 labs. It replaced the retired SEC487.

PaidIntermediate
FoundationsPeople searchDomains & infrastructureAutomationOpSecThreat intelligence

Worth it if

  • Your employer funds training and a job listing names GOSI
  • You want six concentrated days with an instructor who runs cases
  • You need a structured foundation across people, infrastructure, and automation in one week
  • You will take the exam and want the practice tests that come with it

Skip it if

  • You are paying personally; the same skills are available for a small fraction of the cost
  • You use an Apple Silicon or Linux laptop and cannot borrow a supported one
  • You already run cases and want depth; look at the advanced course instead

What is inside

  1. 01

    OSINT and OPSEC fundamentals

    Setting up safely, documenting, and the mindset before any collection.

  2. 02

    Essential OSINT skills

    Search, archives, note-taking with tools such as Hunchly and Obsidian, and capturing evidence.

  3. 03

    Investigating people

    Identifiers, accounts, and the pivots between them.

  4. 04

    Investigating websites and infrastructure

    Domains, hosting, certificates, and enumeration with tools including Amass, Censys, and Shodan.

  5. 05

    Automation, the dark web, and large data sets

    Scripting collection, onion services, and working with big exports.

  6. 06

    Capstone

    A capture-the-flag that uses the week's skills under time pressure.

What you will be able to do

  • Set up and document an investigation so the output survives review
  • Pivot between people, accounts, domains, and infrastructure
  • Automate repetitive collection and handle large data sets
  • Sit the GOSI exam with a realistic chance of passing

How current it is

Actively scheduled with events listed into 2027 and a roster of practising instructors. SANS does not publish a version date on the course page. The course replaced SEC487, which its original author stopped developing in 2022; the historic SEC487 web address now serves SEC497.

Updated
Scheduled through 2027; SEC487 retired after 2022
Maintained
Actively maintained

How to get the most from it

  1. 01

    Get the laptop right a week early

    The requirements are strict and the course media is large. A machine that cannot run the labs wastes the most expensive week of your year.

  2. 02

    Do the free programs first

    Arrive knowing the basics so the week goes to the labs and the instructor's judgement, not to orientation.

  3. 03

    Book the exam within a month

    The practice tests included with the course are the best predictor. Use them while the material is fresh.

Strengths

  • The certification employers recognise
  • Dense, lab-heavy, and taught by practitioners
  • A stable, scheduled course with instructor support

Limitations

  • Very expensive for individuals
  • Hardware constraints exclude some laptops
  • Six days is a lot to absorb; retention depends on practice afterwards

Pair it with

FAQ

Questions, answered

What happened to SEC487?

Its author, Micah Hoffman, left SANS in January 2022 and stopped developing it. SANS now lists only SEC497 and SEC587 for OSINT, the old SEC487 web address serves SEC497, and the GOSI certification maps to SEC497. SANS has not published a dated retirement notice.

What is the GOSI exam like?

One proctored exam of 75 questions in two hours with a passing score around two thirds. Two practice tests are included when you buy the exam with the course.

Is it worth paying for myself?

Rarely. The skills are teachable for far less, and the certification matters mostly where an employer asks for it. If you are self-funding, start elsewhere and revisit when a job requires it.

Learned the method? Practise it on real data

The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.

Create free accountBack to the learning path
  • Free account, no card
  • Credits never expire
  • Refund unused balance in 7 days