Course
SANS SEC587: Advanced Open-Source Intelligence
Matt Edmondson, SANS Institute
The advanced SANS course, overhauled in late 2024 with Python, disinformation analysis, Russian and Chinese sources, crypto tracing, and a hands-on certification. For analysts who already run cases.
SEC587 assumes you can collect and wants to make you analyse and automate. Six sections cover structured analysis and foreign-language OSINT, Python for OSINT, image and audio analysis with AI, sock puppets and the dark web, automated monitoring, and a team capstone against live subjects. It carries the GIAC Strategic OSINT Analyst certification, the first hands-on one for advanced OSINT.
Worth it if
- You collect well and your weakness is analysis, automation, or reporting
- You need Python for OSINT taught in a week rather than a year
- You work on disinformation, Russian or Chinese sources, or crypto and want them in one course
- Your employer funds it and values a hands-on certification
Skip it if
- You have not done a foundational course or equivalent work; the material assumes it
- You are self-funding
- You mainly need platform-specific social media technique; that is not what this teaches
What is inside
- 01
Disinformation, analysis, Russian and Chinese OSINT
Analysis of competing hypotheses, key assumptions checks, foreign agent registrations, and reaching Chinese websites.
- 02
Python for OSINT
Seven levels of Python built for collection and parsing, all new in the overhaul.
- 03
Video, image, audio, and AI
Speaker separation in audio, steganography, advanced enumeration, and gaming platforms.
- 04
Sock puppets, OPSEC, dark web, crypto, wireless
Including cryptocurrency tracing with a North Korea case and a drone detection lab.
- 05
Automated monitoring and locked files
Vehicle tracking, workflow tools such as n8n and SearxNG, and dealing with password-protected files.
- 06
Capstone
A team-based challenge against live subjects.
What you will be able to do
- Apply structured analytic techniques to an open-source question and show your assumptions
- Write Python that collects and parses data for a case
- Analyse audio and imagery with current AI tooling and know its failure modes
- Build a monitoring pipeline that runs without you
How current it is
Reworked in December 2024 with about twenty new labs and a new author, and scheduled into 2027. The certification moved to a hands-on format in late 2025, so independent reports on its recognition are not yet available.
- Updated
- Major overhaul December 2024; scheduled into 2027
- Maintained
- Actively maintained
How to get the most from it
- 01
Refresh Python before day two
Section two is seven levels in a day. Being comfortable with functions and requests beforehand doubles what you keep.
- 02
Bring a monitoring problem from work
Section five builds pipelines. Rebuild one you actually need.
- 03
Sit the exam while the labs are fresh
It is hands-on, so lab memory matters more than reading.
Strengths
- Covers analysis and automation, which most OSINT training skips
- Recently rebuilt rather than patched
- Hands-on certification instead of multiple choice
Limitations
- Expensive
- Dense enough that retention depends on immediate practice
- No independent reviews of the new version yet
Pair it with
- ReadCoursePaidIntermediate
SANS SEC497: Practical Open-Source Intelligence
Recommended but not required before this one.
- ReadBookPaidIntermediate
Structured Analytic Techniques for Intelligence Analysis
The source text for the analysis methods in section one.
- ReadBookPaidIntermediate
Black Hat Python, 2nd Edition
To keep the Python going after section two.
FAQ
Questions, answered
Do I need SEC497 first?
SANS recommends it but does not require it. The author has written that SEC587 assumes some SEC497 knowledge, so equivalent working experience is the real prerequisite.
What changed in the overhaul?
New Russian and Chinese OSINT content, AI-assisted audio and image analysis, steganography, a Discord gaming lab, crypto tracing, a drone detection lab, and a full Python section, announced in December 2024.
Learned the method? Practise it on real data
The resources above teach the craft. When you want to run real lookups across breach, people, domain, and crypto sources without opening a dozen vendor accounts, that is what SearchIn is for.
- Free account, no card
- Credits never expire
- Refund unused balance in 7 days