Collection Maps - Build Spec & Target Shapes
How the per-deliverable XMind collection skeletons are built. Each deliverable in
deliverables/<type>/gets a companion skeleton incollections/<type>/<did>-<slug>-collection.mdthat the operator imports into XMind and fills during collection. Exemplar / gold standard: OSINT-001-standard-subject-dossier-collection.
1. What these files are
XMind-import Markdown. The operator imports the .md, gets a mind map whose central topic is the
investigation target, branches are the data-point categories for that deliverable, and leaf nodes
are empty placeholders to paste collected values into. Each collected value is itself expandable
(value → where it was found → what it links to), and raw tool output goes in the node’s Notes.
These are collection workspaces, not vault documents - they are the input/staging layer that
feeds the finished deliverable in deliverables/.
2. Import conventions (XMind) - follow exactly
- First line is the central topic -
# [TARGET] - Collection Map. No YAML frontmatter. A leading---would corrupt the import (first line must be the#topic). - Headings
#–######and list items (-) both become topics, nested by heading level and by list indentation (4 spaces = one level deeper). Up to 6 levels. - Blockquote
>directly under a heading = that node’s Notes / guidance. Use it for “what goes here” and the→ §Nmapping to the deliverable section the branch feeds. Keep guidance in notes, not in leaf nodes. - Leaf placeholders use brackets:
- Field name: [ ]or- [value - e.g. example]. Brackets signal “fill me in.” Keep leaves clean (no prose) so they are fast to overwrite. - Numbered branches
## 00 · …through## 99 · …so XMind preserves order.
3. The recursive selector / entity block (the core mechanic)
Any selector or entity that can recur (usernames, emails, phones, wallets, associates, suppliers, indicators…) is seeded once as a clonable block: a value node with indented pivot children. The operator duplicates the block per value.
### Usernames / handles
> → feeds §8 Digital Footprint, §5 Identity. Clone the block per handle.
- [handle - e.g. csmith200]
- Platforms / where found (URL): [ ]
- Linked email(s): [ ]
- Linked phone(s): [ ]
- Other accounts reusing it: [ ]
- Attribution confidence: [Confirmed / Probable / Possible]
- Notes / tool output: [ ] ← idcrawl, sherlock, whatsmyname
- [handle 2]
4. Required spine (every shape)
## 00 · Collection Plan - PIRs & EEIs- the questions this collection answers + essential elements of information as checkboxes, mapped to the deliverable’s PIR / Key-Judgment sections.- …shape-specific branches (§5)…
## 99 · Collection Admin- source register (graded), evidence archive, running gaps / RFIs.- Monitoring/continuous deliverables (service type, or
engagement_model: continuous, or a dashboard/feed system) also add## 00b · Monitoring Cadence & Triggers(watch items, refresh cadence, alert thresholds, escalation).
5. Target shapes (branch palettes)
Each deliverable is assigned ONE primary shape; the writer adapts (adds/prunes branches) to the
deliverable’s actual sections. ★ marks branches that carry a recursive block.
A · PERSON / SUBJECT - root = an individual
00 Collection Plan · 01 Identity & Biographic · 02 Contact & Selectors ★(phone/email/username) · 03 Addresses & Locations · 04 Digital Footprint ★ · 05 Network & Associations ★ · 06 Employment, Education & Affiliations · 07 Financial & Lifestyle Indicators · 08 Legal & Derogatory · 09 Media & Imagery · 10 Pattern of Life · 99 Admin
B · ORGANIZATION / ENTITY - root = a company/entity
00 Collection Plan · 01 Entity Identity (legal name, reg #, jurisdiction, incorp date, status, type) · 02 Corporate Structure ★(parent/subsidiaries/UBO/org chart) · 03 People - directors/officers/UBOs/key staff ★ · 04 Registrations & Filings · 05 Digital & Infrastructure ★(domains/IP/email patterns/social) · 06 Financials · 07 Commercial Footprint (locations, customers, suppliers, contracts) · 08 Legal, Regulatory & Sanctions · 09 Reputation & Adverse Media · 10 Network & Affiliations ★(related entities, shared infrastructure) · 99 Admin
C · PLACE / GEOPOLITICAL - root = a country/region/area/theme
00 Collection Plan · 01 Geographic & Administrative · 02 Political & Governance · 03 Security & Conflict · 04 Economic & Infrastructure · 05 Social & Demographic · 06 Key Actors & Entities ★ · 07 Legal & Regulatory Environment · 08 Indicators & Events ★(timeline) · 09 Sources & Media Landscape · 99 Admin
D · ASSET / FINANCIAL - root = a holder (person/entity) + their assets
00 Collection Plan · 01 Target Identity (holder) · 02 Real Property ★ · 03 Corporate Holdings & Business Interests ★ · 04 Financial Accounts & Instruments · 05 Movable Assets ★(vehicles/vessels/aircraft/art) · 06 Cryptocurrency & Digital Assets ★(wallets/exchanges/tx) · 07 Income & Source of Wealth/Funds · 08 Liabilities & Encumbrances (liens/judgments) · 09 Hidden / Nominee Structures (shells, nominees, offshore) · 10 Network & Facilitators ★ · 99 Admin
E · EVENT / PROTECTIVE / OPERATIONAL - root = an event / principal / venue / movement
00 Collection Plan · 01 Principal / Protectee or Event Detail · 02 Venue & Geography (site, layout, ingress/egress) · 03 Routes & Movement ★(legs, timings) · 04 Threat Actors & Persons of Interest ★ · 05 Threat Landscape (incidents, history, online chatter) · 06 Vulnerabilities & Attack Surface · 07 Local Environment (security/medical/LE, infrastructure) · 08 Digital & Social Signals · 09 Indicators & Warnings ★ · 99 Admin
F · CYBER / EXPOSURE / DARK-WEB - root = the digital identity / attack surface of a person or org
00 Collection Plan · 01 Identity Anchor · 02 Selectors & Accounts ★(emails/usernames/phones) · 03 Credential & Breach Exposure ★ · 04 Dark-Web Presence ★(markets/forums/leak sites/mentions) · 05 Digital Footprint & PII Exposure (data brokers, public records, social) · 06 Infrastructure ★(domains/IPs/assets) · 07 Attack Surface & Vulnerabilities · 08 Attribution & Threat Actors · 99 Admin
G · FORECAST / INDICATOR / MONITORING - root = a question / topic / program
00 Intelligence Requirements (KIQs/PIRs) · 01 Drivers & Key Variables · 02 Indicators & Warnings ★(indicator → observations/thresholds) · 03 Scenarios / Hypotheses · 04 Data Sources & Feeds ★(source → cadence/reliability) · 05 Key Actors & Entities ★ · 06 Events Timeline ★ · 07 Assumptions & Uncertainties · 99 Admin
6. Deliverable → shape map
| Shape | Deliverables |
|---|---|
| A PERSON | 001, 002, 003, 004, 005, 006, 007, 008, 009, 012 |
| B ORG | 010, 013, 014, 015, 016, 017, 018, 035 |
| C PLACE | 026, 027, 028, 030, 031, 032, 033, 036 |
| D ASSET | 011, 019, 020, 021, 022, 023, 024, 025 |
| E PROTECTIVE | 034, 042, 043, 045, 046, 047, 048, 049, 050, 051, 052, 053, 054, 063 |
| F CYBER | 044, 055, 056, 057, 058, 059, 060 |
| G FORECAST | 029, 037, 038, 039, 040, 041, 061, 062 |
Blends are expected (e.g. 020 net-worth = ASSET on a PERSON; 035 supply-chain = ORG across PLACES; 022 crypto = ASSET with CYBER infrastructure). The writer keeps the primary shape’s spine and grafts the secondary branches the specific deliverable needs.