Your first case in five minutes

OBSCURIQ is a desk for open-source research. A workspace holds one or more cases; each case has a brief, a purpose note and a research log — a timestamped list of sources, indicators, notes, opened pivots and inspected files. Nothing is collected in the background: every link and lookup starts with your click.

1. Open the example

Click Launch OBSCURIQ on the app page, then File → Templates… and choose Look-alike login domain. The example is fictitious (reserved example domains and documentation IP addresses). It replaces the current workspace; your previous one stays under File → Recent workspaces….

The left column lists the cases of the workspace. The header shows the active case: its name, status (Open), the brief and a row of counts — entries, sources, indicators, notes and how many entries need follow-up.

2. Read the research log

The Research log tab lists the entries newest first. Every entry shows:

• its type (Source, Indicator, Note, Opened pivot or File) with a coloured edge,
• the title and the time it was recorded,
• the value (a link, an indicator or an observation) and the context — where it came from and why it matters,
• the review status, your source assessment for sources, the event date and tags.

Click a tag such as #phishing to show only entries with that tag. Use the search box to find text in titles, values, context and tags, and the selects to filter by type and review status or to sort by Event date: oldest first. Showing 3 of 7 entries. tells you a filter is active; Clear filters resets it.

3. Review an entry

Open the More actions menu (☰, top right of the entry Look-alike domain) and choose Reviewed under Review status. The badge turns green and the follow-up count in the header drops. Click the pin button to mark it as a key lead; pinned entries get a frame, are listed as key leads in the case report and can be filtered with Pinned only.

Review status and source assessment are your own notes. OBSCURIQ never presents them as verification.

4. Add your own source

Press Add entry (or the N key) and fill in the dialog:

1. Type: Source.
2. Title: Registrar abuse page.
3. Value: a URL — the dialog recognizes it and shows Recognized as: URL.
4. Context: why you need it.
5. Event date (optional): when the event happened — not when you recorded it.
6. Source assessment: High, Medium or Low.
7. Tags (comma separated): for example phishing, report.

Choose Add to the log. The new entry appears at the top with the current time. Undo (Ctrl+Z) removes it again, Redo (Ctrl+Y) brings it back.

5. Keep your work

The status bar says Autosaved in this browser after every change. Browser storage can be cleared, so use File → Save workspace file for a portable .obscuriq.json file, or File → Copy share link… to put the whole workspace into a link. Both are not encrypted — share them only with people who may read the research.

Next: Pivots and lookups.