A tabletop plan must satisfy current warning version, capacity, timing and fallback constraints together.
Advanced OSINT practice starts when several plausible observations point in different directions. The task is not to invent the most dramatic explanation. It is to identify which records are independent, what their timestamps mean and what a proposed conclusion would require.
Contemporary context
WMO’s Early Warnings for All framework connects risk knowledge, monitoring, warning communication and response. These synthetic cases practise those distinctions; they must never substitute for current local emergency guidance.
WMO · Early Warnings for All, consulted 6 October 2026. Source checked on 6 October 2026. Public guidance is separate from the invented evidence in the exercises.
Five progressively harder investigations
Operation Warning Relay: Versioned warning and reversible planning
Use warning version, validity, capacity, timing and r ever sibi lit y together. A recent repost may carry obsolete content; preserve an explicit update point instead of treating one plan as permanent.
A fictional flood response desk compares two routes and contradictory warning versions. Choose a reversible decision using the official version valid at dispatch time. This is not real emergency guidance.
Investigate the advanced dossier
Operation Evacuation Window: Capacity scheduling and contingency margins
Compute both total and specialist capacity and distinguish baseline feasibility from resilience to delay. A plan that fits exactly may need a fallback even when its nominal arithmetic is correct.
A fictional controlled evacuation has two shuttles, accessibility needs and a closing route. Determine feasible capacity without exceeding the stipulated safety constraints.
Investigate the advanced dossier
Operation Aid Inventory: Inventory conservation and stale dispatch claims
Reconcile physical, usable, reserved and deployable quantities separately. Delivery-time feasibility cannot repair a material shortfall, and duplicated status messages must not be counted as separate movements.
A fictional relief cache has duplicate dispatch messages and reserved supplies. Calculate genuinely deployable inventory before selecting a requested load.
Investigate the advanced dossier
Operation Route Staleness: Age-weighted reporting and observation types
Rank the timestamp of the observation separately from delivery speed or interface freshness. When neither option meets the decision constraints, verification or a pause is a valid output rather than forcing a choice.
A fictional operations desk receives contradictory route reports. Distinguish observation age, relay latency and travel constraints before choosing a verification action.
Investigate the expert dossier
Operation Consent Corridor: Data minimization and authorized destination
Treat purpose, data fields, destination and retention as separate permissions. A useful brief can contain less data and still fulfill the task; a new recipient or precise location content changes the authorization question.
A fictional humanitarian team needs a route brief but receives a file with precise personal addresses. Apply the explicit sharing scope and compute the minimum safe payload for this exercise.
Investigate the expert dossier
A reusable evidence worksheet
- Record the observation. Preserve the original wording, identifier, timestamp, source and uncertainty. A quoted claim is not the same as an independently verified event.
- Normalize without overwriting. Add a corrected time or comparable amount beside the original. Write the timezone, clock error, unit conversion and rounding rule so another analyst can reproduce it.
- Trace dependency. Identify copied reports, shared instruments and derived records. Several displays may still represent one originating observation.
- Test the competing explanation. Look for a control, alternative version, ordinary mechanism or missing authority that could produce the same visible result.
- State the boundary. Separate established observations, reasonable inferences and unresolved questions. Name the additional independent record most likely to change the assessment.
How these cases level up your practice
Each dossier contains eight synthetic evidence records and seven graded objectives. The first three investigations in this category are Advanced; the final two are Expert. Difficulty comes from multi-record reconciliation and calculation rather than hidden internet searches or obscure trivia. The brief states the necessary assumptions and answer format. You can keep a narrative analysis in your notes while the engine checks the decisive short answers.
Hints are progressive. Start with the structure hint, use the method hint if you need a way into the problem, and reserve the worked-resolution hint for learning after a genuine attempt. Final-answer reveals are a learning review and do not establish an unassisted investigation result. Published methods here explain the approach without reproducing the seven graded answers.
Frequently asked questions
Are these real incidents?
No. The records, identities, organisations and events are fictional. Where public current guidance is linked, it supplies a topic context rather than authentication of a dossier.
Do I need to contact or scan a real target?
No. The supplied packet contains the evidence needed for the objectives. Do not identify private people, access restricted systems or treat a tabletop route decision as real emergency guidance.
Can an unresolved conclusion be correct?
Yes. A sound investigation can establish a discrepancy while leaving identity, intent or cause unresolved. Report the supported result and the evidence required to go further.