obsidian-osint-templates is a starter vault for documenting investigations

Templates for a case file, not a tool that gathers evidence

obsidian-osint-templates is a set of suggestions for how the Obsidian notetaking tool can be used during an OSINT investigation. That is the whole scope, stated in the repository description and repeated in the README.

The interesting part of the framing is that the author is not selling a method so much as demonstrating one. The README says the example data in those files should allow you to make connections between how you record your data during an investigation and some of what the tool can offer, and it invites the reader to look at what was done in the example files rather than just copy the structure.

That is an unusual thing for a template repository to do. Most publish a set of note skeletons and stop. This one ships filled-in examples so that the value of the structure, the linking between notes, is visible rather than described.

The tool at the centre is Obsidian, and the README deliberately refuses to explain it. Instead of a tutorial, the author points to the Linking Your Thinking YouTube channel for free videos and to the Obsidian help documentation, and urges the reader to watch those and take notes. The reasoning is plain: the templates only pay off if you already understand how the application works, and the application has better explanations of itself than a template repository could provide.

So the audience is not someone looking for open source intelligence software. It is an analyst or OSINT practitioner who has chosen Obsidian as their note store and wants a workable case-file structure rather than a blank vault.

What is actually in the vault

The repository listing describes the structure of the vault, and the directory names say more than the README does.

There is a templates directory, which is the reusable part of the vault, the note skeletons you copy and fill in. There is a Standard Operating Procedures directory, which is the procedural spine of the approach and, for an organisation, the most interesting directory in the repository because it is the part you would want to argue about and standardise. There is an examplecase directory holding a worked example, which is what the README points at when it invites you to make connections between the templates and what Obsidian offers for free. There is a .obsidian directory, which holds the application configuration for the vault so that the workspace settings, the plugin set and the graph settings travel with the repository instead of living on one person's machine.

Then there are the entry points. A file named START HERE.md, an Introduction Presentation.md, and the README itself.

The .obsidian directory deserves more attention than it usually gets, because it is the difference between a vault and a folder of Markdown. Obsidian stores its settings inside the vault, so committing that directory is what makes a shared vault look the same for everyone who opens it: the same panes, the same settings, the same plugin configuration. For a template repository aimed at handing a structure to other people, that is a deliberate and load-bearing choice.

What the listing does not tell you is the size of the templates set, the note formats, or the plugin list, because those details live inside the files rather than in the README.

The author's own resources sit alongside the free vault

The README also lists the resources the author has made to help OSINT practitioners start their Obsidian journey, and it is worth being precise about what is free and what is not.

First is a blog post on the author's site about Obsidian. Second is a YouTube video demonstrating an older version of Obsidian, and the description says so plainly, which is a small but useful detail: the recording predates the current release, so what you see in it may not match the interface you have today. Third is an Obsidian course that teaches how to set it up, configure it and start using Obsidian in OSINT work, hosted on myosint.training.

The README describes these as several free and paid resources, and the distinction is real. The templates in this repository are free and openly licensed. The course is the paid part, and it covers the setup and configuration work that the README itself declines to document.

That division is the most useful thing to understand about the project. The repository gives you the structure, the worked example and the operating procedures, and it points you elsewhere for learning the application and building the habit of using it. If you were expecting a self-contained course in a repository, this is not that.

It also means the repository sits inside a broader set of offerings from one author, which matters when you weigh it as a dependency: adopting the vault is adopting one person's workflow, one person's procedures and one person's example case.

Why the example data matters more than the templates

The README puts the example files first for a reason, and understanding why is the difference between copying this vault and using it.

The value of a note template is that it constrains what you record, so that later you can find and connect it. That constraint is invisible in an empty skeleton. An empty template teaches you the headings and nothing about the judgement behind them: which fields you actually fill in, what you leave blank, how you phrase a finding so that you can link it to an assessment, and how you record something you could not verify.

A filled-in example shows all of that, because the example is a record of one analyst's decisions. That is also its weakness. The example case embodies assumptions about scope, about the order of work, about what counts as an observation versus an inference, and those assumptions are the analyst's, not the format's.

So the templates are best treated as a starting point that you expect to rewrite. The example data is best treated as a worked argument, not a standard to copy. The README asks the reader to look at what was done there, which is an invitation to argue with it.

For a team, this is where the real work sits. Standard operating procedures that survive contact with a real investigation are the ones that have been argued over and adapted, and this repository gives a team a concrete document set to argue over rather than a blank page.

Where these templates are the wrong tool

The limits are worth stating plainly, because the project is easy to over-read.

It gathers no evidence. Nothing in the repository collects, verifies or stores OSINT data. It is a documentation structure for data you already hold, and any expectation of automation or collection is misplaced.

It does not teach the tool. The README is explicit that you should go and read the Obsidian documentation and watch the videos, and that the course for setup and configuration lives elsewhere and is paid. If your problem is that you do not know how to use Obsidian, this repository does not solve it.

It does not tell you what the templates contain. The README describes the approach in a paragraph and points at the files. There is no catalogue of the templates, no mapping of note type to purpose, and no guidance on how many of them there are. You learn the structure by opening the vault and reading it, which is fine for a template repository and useless if you need to evaluate it remotely.

There is also no versioning. The repository publishes no GitHub releases, so there is no tag to point a colleague at, and the last push was on 2026-06-14. For a vault you intend to standardise across a team, that means you should copy the files into your own storage rather than pulling from the repository, so that an upstream edit cannot silently change your procedures.

Finally, the procedures carry risk. Standard operating procedures written by one practitioner for OSINT investigations will not match your organisation's legal position, your disclosure obligations or your handling rules. The templates are a starting document, and the procedures in them need review before anyone follows them on a live case.

CC BY-SA 4.0 and what it means for a team standard

The licence is stated in the README in a callout at the top, credited to Copyright 2024 Micah Hoffman, and it is the Creative Commons Attribution-ShareAlike 4.0 International License.

The attribution part is the easy half: keep the credit, link to the licence, and say what you changed.

The share-alike part is the half that matters for a team. If you adapt these templates and the standard operating procedures into your own documentation, that adaptation has to be released under the same licence. For an internal handbook that is mostly a non-issue, but for anything you publish, a client-facing methodology or a commercial training product, the viral clause travels with the adapted text and you have to license your own additions the same way.

That is not an argument against using the templates. It is an argument for reading the licence before you copy the standard operating procedures into an internal wiki, because an internal copy that is later turned into a public document has to respect the same terms.

The repository itself carries no other licence metadata, and there are no tagged releases, so the README callout is the authoritative statement of terms and the files as they stand on the main branch are the only version available.

Everything in this vault is a plain text file in a folder, which is the practical upside of the whole arrangement. Whether that matters to you depends on how you already keep notes, and it is the first question to answer before copying a single template.

Editorial conclusion

Analysts who already keep notes in Obsidian and want a starting structure for a case file should take the templates and adapt them, because the vault shows a concrete way to link recorded observations back to sources and next steps. It is the wrong tool for anyone who has not decided how they will store notes, since the templates assume a working practice rather than create one, and it is the wrong tool for teams that cannot accept the share-alike licence terms. Before adopting, read START HERE.md and the standard operating procedures folder, confirm the licence is acceptable for a team-wide standard, and note that the last push was on 2026-06-14 with no tagged releases to pin.

Frequently asked questions

Official sources

1. Issues
2. README
3. WebBreacher/obsidian-osint-templates on GitHub