Transcription
Yo, what's going on guys? Welcome back. Today I'm doing a video that I actually planned on doing last week, but um some stuff came up, but it's very interesting.
So, most of you probably have heard of Palunteer hopefully um and we're going to talk about what it is and everything else, but a new tool came out called Osiris. And I was scrolling Reddit and looking and like one of the things I saw on there explicitly was Osiris is the open-source um Palunteer replacement. And immediately in my head red flags were going off. Like, is it really though? Let's go look.
So, I went and looked at it and I thought, this is something that I really want to do a video on because I really want people to understand the difference and also understand they aren't even the same class of tool necessarily. And so, I want to kind of talk about it and talk about the difference in them, where the value lies in both of them, and why it's important. Because if you work for large companies or defense contracts and any of that stuff, you've probably heard of Palanteer or and or used it.
So before we get started, guys, please check out the Patreon, the Discord, like, subscribe, do all that stuff because it really helps the channel grow. It's the only way to grow. And the Patreon will actually have a full standup of how to do this um at the end. Um, so I'll be making that video as well. So that a self-hosted Palent or I almost messed up myself. They've got me messed up. A self-hosted Osiris with threat intel and all of that. So, let's go and dig into it.
So, the first thing is what is Palunteer? So, most of you have probably seen this in movies with like where it's like a globe and they can just like click on something and boom, cameras pop up and boom and this and that. That's kind of what Osiris is playing on. It's playing on the fact that you're going to think of it like the movies. But the reality is Palunteer, it's 2026. Palanteer has been around since 2003. So 23 years of actual building, whereas Osiris, we'll talk about it, but it was clearly C claw co code builded built. I don't know what that word was, but it was clearly built on clawed code, which is fine. Um, but understand 23 years of building a product probably has a better shelf life than you know this. And not necessarily saying that that's true. I just saying it's probably.
Um, so the big thing that people talk about is Palanteer was originally funded by the CIA, right? And people think that might be a conspiracy or whatever. It's it's not. It's on their Wikipedia page. You can go look. um they say it was funded by them by CIA's venture fund. So it's not like this is like new information or anything. Um, just understand that that's just how it started, right? So it makes sense that initially it was for DoD, DOW, um defense contracts, that type of thing. The first thing they had was Gotham. Gotham was their defense and intelligence. So again, defense. So what this did, it took data, just data, right? Think about your threat intel feeds as a security analyst and stuff. It took data and it took that geospatial human intelligence, all of that, and it put it into individual spots on the map, right? It let you formalize it. So, it allowed you to see, oh, I've got planes here, I got this here, I got this here, I got this here, right? And it allowed you to use all of this to understand intelligently the big picture. Pretty simple, pretty easy, right? You could take all kinds of stuff, financial records, all that stuff. It just allowed you to paint the picture. The map really doesn't matter. It's how the data correlates to each other, how it talks. It's just a threat intelligence platform. Okay, that was the original product. Okay, so it makes it into a single picture that you can clearly understand. That was the original product.
Um, then they went to Foundry. So this is the commercial version. So first you had the CIA, defense contracts, all that stuff. And then they went to Foundry, which is same thing but for enterprise data. Why does this matter? Well, IoT devices, things about like that. Think about if you're in critical infrastructure, if you're hospitals, all that stuff. It matters if there's a cyber incident next door. It matters if there's IoT devices like yours being taken over on this side of the world because if you watch the trends, you could probably watch it move across the world. Think about um Scattered Spider. They go industry to industry to industry. So it matters if you see Skyward Spider in this industry and now there's jump in this industry and now they jump to this industry and guess what? You're in this industry and you know about it. As soon as you start to see that trend go across the the trend line, you start to be able to prepare. So it matters. Data matters, right? Intelligence on that data matters. So that was where Foundry came in. This is the commercial version being sold. I think it's like 100 plusk a year. you know, typical SAS solution costs and stuff like that.
So then now they have the the Apollo, right? The um the AI AI piece of it. And this what this does is the AIP or AI platform, right? Just layers it all together. It's a LLM that put all that together. It reasons your data, your organization's information, gives you what's valuable, right? It contextualizes it for you. It saves you all that time of before you had all the data and you had to go okay yes most of this is relevant but I either tune it or I look at the big picture and I say this is what matters to me now AI can do that for you which is really really useful um or I I said uh Apollo but I was talking about AIP as obviously you can see that so um the AIP is the LLN that I'm talking about right so that's the the big one the Apollo is the deployment engine this manages software rollout cloud onrem classified all that that's just part of their offering. Doesn't really matter. Um, but this is what Palunteer as a whole kind of offers.
So, when you say you're a replacement, an open-source replacement, two things pop in my head. A, you're using Palunteer's name to get marketing, which is what they're doing in this case. But if you're doing that, you have to have some serious stuff to back that up. If you can't, then im people like me and and I might be an outlier. Immediately I go, I don't want to use your product because you're lying and I don't like that. And so I don't know who their marketing team is. I understand it actually got a ton of publicity because of this and it made things, you know, people really talk about it and I understand that, but I don't like the lying part of it because really all it is is this piece together. And the reason I say together is because it's really this piece, the foundry piece. It's really only one phase of it. And it's not even that phase the same way. So, we're going to talk about that.
So, the power again is not on the map. And we're going to show you I'm going to show you the map. It's not on the map. The map is just a way to visualize the the data. Doesn't really matter. The power is how that data underneath gets structured, parsed, handled, and categorized, and um all that. So we'll go ahead and go to the next one.
Here's a here's the reality, right? Palunteer, we've talked about who uses it. Some ba major major players starts at 100K. Pretty normal. Now look at this usage base negotiated monthsl long enterprise onboarding. It takes months long for an enterprise to onboard this. There's no free tier, right? The reason that's really important, the month-long stuff, is because Osiris is acting like you can go, and again, they they didn't necessarily claim this, but people on Reddit that use it are acting like you just go to the website and boom, you have a replacement for this. It takes companies months, right? And so that's not something that you take lightly. It's not going to be something that you stand up and then 10 days later you've got a equivalent. It's just not real. So, a lot of marketing hype.
So, let's go ahead and dive into what Osiris is. So, this is the map and you can see I'll zoom out. You got a map of the world, right? And it just defaulted here to Ukraine or somewhere near there. Um, and you have all of these tabs on the left that you can check, right? And these are all feeds, data layers. So, we're going to talk about these data layers here in a second. Then you have these region presets. These are hot spots where things are going on. So you can click on them and um see what's going on. Then you go down. That's one thing I don't like about the interface is sometimes if you're like here and you you're scrolling, it's not scrolling. It's just um moving. You can see I'm just moving. So it's kind of a pain to scroll. The other thing I want I want to point out is this is very obviously claw generated, which is okay. That's up to, you know, I I don't have any issue with using AI to code. I'm just wish they would have changed some of the themes so it doesn't look so claw generated. Um, you can see here they've got market impact analysis um and different kind of alerts. The straight of hormuse um and it looks like they're saying hey heads up there's going to be um some oil is going to go up right. Okay. Yep. Markets. So you actually have the um market S&P 500 is up. The defense all that stuff. So just market information. Then you have this recon toolkit which we'll talk about. And then you have live alerts. So these are things that are happening. So one thing I'm going to do is I'm going to refresh. The reason I'm going to refresh is because I I have not seen those alerts change. And you can see since 11:00 a.m. Um it says it it said it started at 11:02, but that was the same alert that was there just a minute ago. So it wasn't. Um, so you can see I have everything to check.
So, first thing we're going to do is say, okay, what what information are we looking at? Let me move this out of the way here. Um, the live demo. I want to just get this out of the way. I'll redo it here in a second. So, the big thing is [sighs and gasps] here's where you're got to understand how these things work. The very first one is the most important thing on a map like this or on a platform like this is the intelligence and the data sources. These are all public feeds. If you go to the site Osiris AI.live, these are all public feeds. The other thing I don't like is they're emphasizing, and this isn't me on them. This is a I'm going to talk about how it's a cool product, too, but the marketing is not doing them any justice in my opinion. So, the Osiris AI name sounds like this has something to do with AI. Besides the fact that it was built on AI and it gives you an AI summary of alerts, there's not really anything AI about it. So, I don't really love that. Another big thing that I want to talk about is the the sources they use because the data sources are super important.
So, one of the first things is they use for aviation they use just public feeds. So if you click on this, you can look it's very slow and you can look I have zero planes right now. That will change. It will eventually load planes in hopefully. It was loading them in sometimes, sometimes it wasn't. So you can see sporadic already because it's based on public feeds. If it can't pull the public feed, if anything happens, whatever, you don't get the data. That's a pain in the butt, right? Excuse me. Same thing with all these feeds. Maritime, Maritime, whatever you want to call it. Um, there's again and space it is based on public feeds CCTV again you can see this area has a ton of CCTV I'm not sure why but you can click on this and you can see that road this seems really cool and a little bit dangerous right but the reality is if you look at it look at the world here it is only in certain parts of the world that this actually works. And the reason for that is pretty self-explanatory. This is all public feeds. So, wherever the public feeds are available, that's all it's pulling. So, there's 3,425 cameras in the world that are broadcasting to this. Sounds like a lot, but if you think about it, it's really not, right? So, that's another thing I want to point out is the information is very sporadic. The main reason it relies on public feeds. Public feeds are not funded. They're not maintained in the same way. Yeah, they can be funded sometimes, etc. There's ways for that, etc. But the difference here is the data. Palunteer has extremely good data sources. It has 23 years of building data sources of it has classified, unclassified, military, aviation, all of that stuff. It's got really good sources. So, it's like the difference of you ingesting um your own threat intel feed and or buying mandant Google's right. Obviously, Google has a full team dedicated to this. You don't. So, the data is going to be as useful as the information you feed it. Where in this case, it's all public source and I've only been able to get the the planes to pop up a couple of times. So, you can see you're going to play with this a little bit. It's a pain in the butt. The other thing is the these like uh little global alerts of things happening, stuff, they're delayed. They're not a live feed. They're they're again public feeds. So, it has to try and pull the data. It'll give you kind of a a time um stamp in time, but again, you're not getting the real live feed that you're getting when you have a Palunteer or something like that with dedicated bandwidth, dedicated um you know, a lot of times it's going to be in a SAS application that they're managing, etc. And they have the funding for you can see down here there's just a little ticker. It's really small, so I can't imagine you see it, but it says CVE. Cyber 10 CVEEs. I don't even know what that's talking about. I don't know if there's some CVE that that they're talking about somewhere. Um, you have these feeds. You can go just click on Sky News and you get a feed. As you can see, a lot of these videos are unavailable. That's because it's a snapshot in time. They might have been available at that time, but they're not available now. You can click on this and it takes you right to that source. So you can actually start to see some of this. So it is valuable, but it's more valuable for a world overview perspective. There's no value right now that I would see in taking this and using as a daily driver right now other than just interest.
Okay. The other thing I want to point out here really really clearly is this recon toolkit port scanning. So this is where I I don't know what they're doing or how they're doing it, but it is actually I mean it depends on where they're I don't know where they're hosted, but it is illegal to port scan a lot of companies or a lot of websites if you're um if you're in certain areas. So, if you run this port scan and then you hit an illegal area, now 99.9% of the time, nobody's going to come after you. But if everyone anyone someone wanted to pursue it, they would come back to Osiris and say, "This came from your IP. I'm subpoening you." And then they would go, "Okay, well, who did that?" And that would come back to you. So, this is such a gray area to have this recon toolkit here. um a gray area as far as legality. And so I don't know, I will never run a port scan on here. Um Showdan's a good example. You can run a port scan on Showdan. Um, but Showdan has a lot of uh basically acceptable use and stuff like that. I don't see anything on here that tells you not to do it. What only do it on things you own, that type of stuff. So from a legal perspective, I'm not sure how that plays out. Um, but I I wouldn't mess with this if I were you because this is still you doing it regardless of if it comes from your IP. So just understand that.
Okay. So now one thing I want to talk about is Palunteer's Gotham, right? It's the geospatial layer the which is exactly what we're looking at. So the map-based analysis that they use over this fused just like intel sources sitting here, right? The Osiris does map-based analysis over these public feeds. So, same concept, same thought, which is what we talked about. Is it just the one piece of Palunteer? But the data underneath it is so different that right now it's not even the in the same world class. It's not even we're not even going to talk about now. We're going to talk about the the value here in a second. The other thing is Osiris is basically a competitor to Palunteer. That's just a myth. That's just not even real, right? That's they they designed it to look like Palanteer. I understand why. Like this is a cool project, but it's not a replacement. It's not even close. Um, they used Palunteer's name to grow and to basically try to grow this thing and make it bigger than it actually is. I understand why they did it, but just be real with what it is. Don't get caught in the hype.
One thing I want to talk about is the head to head. If you put them head to head. So if we turn on every source here, we see the map start to light up. Right now go look at some places. Like we can go right here. You're telling me this is all the stuff in the US, all the stuff in Mexico, all the stuff down here in Brazil. No, there is so much more that you would have to pay to get access to. You can see you have to embed or open a lot of this in YouTube, which I understand. Um, this here just satellite view. It just takes you to Google Maps. So, it's not like this has a bunch of capabilities built in. It just takes you to other feeds, which is fine. Again, for the open source piece, there's really for what it is, it is pretty good because it is just all open source, but there is no realistic view of the world here. I mean, you have entire areas just missing a ton of stuff and then you have entire areas that are just mapped out, right? And that's based on the data. The data is not there.
So, the category of tool is enterprise AI data analysis. That type of thing for Palunteer. For Osiris, it's just a Osent dashboard. That's all it is, right? The data source for Palunteer is your internal data. And Osiris, the web app, is just public internet. The cost obviously 100K versus zero. Pretty obvious there. The setup is just go to it, run it easy or clone it on your personal machine, run it easy versus Palanteer takes months. The AI layer. Osiris doesn't really have it. It's just a summary summarization of the news here, but there's nothing really here. Palunteer has very deep AI layers and so it agents that run over your data and everything else. So that not even in same comparison governance, there is no governance built into this. There's no legalities built into this. There's no anything where that's a really big thing with Palunteer. They've been around for a long time, so they understand that and that will cover your butt a lot. Um, Palunteer. The difference is I can't self-host Palunteer. They have to help me host it. I can self-host this because it is open source. So, I can do it. It does have this recon toolkit that I would not use, but it does have it. Um, and obviously Palunteer doesn't have that because that's not what they're trying to do at all. Um, not even really sure why. But the biggest thing is again, I'm not going to mess with this because it's coming from their IP, but I'm still doing it. And so you get into a legal gray area. I don't want to mess with it.
So let's go back to the slides and talk about the good of it, right? Because it's pretty self-explanatory. It's pretty easy to use. But okay, welcome back. So I finished recording, but um it actually my screen went black when I switched over back to PowerPoint. So what I want to talk about is who should actually use Osiris. And the reality is if you're someone that just is interested in global events, it's it's a very great dashboard. You just log in, click on where you're interested, look at the feeds, look at the threat. I mean, it's pretty awesome. The the threat intel analysts. So, if you're just looking for situational awareness, if you're a company that you know, you guys travel a lot or you're you travel a lot or anything like that, you can go and just look at what are the conditions, where is this person going, is it safe, should we even allow them to travel there or should we not, right? Um, OENT researchers again very easy, fast geographical correlation. You can go this event happened here, this event happened here, they're correlated here, da da. Very easy, very simple. You can even just not even have to host your own. Just look on the on the website. Junior analysts, I think it's really important for junior analysts to learn this because or to use this because it shows how data correlation works. It doesn't necessarily need um you don't need to necessarily go through and be like an expert in it or anything but I think a lot of people when they're learning cyber security just security in general um OSEN all that stuff they understand data they don't understand the intelligence and this adds the intelligence layer it lets you see the correlations let you see the data be in play the small security teams I think if you host this self-host this for yourself and then ingest your own data you're going to see that these this has some great insight. There's geopolitical context that could affect you. There's you can watch APS move across whatever environments and you can say hey I see a supply chain spreading like things like that and you can actually correlate that data. But I think for the most part if your team already has a threat feed and a good threat feed any enterprise tool is going to be better than this most likely unless you want to set spend a long time. There's nothing wrong with you saying, "I really want to spend a really long time and build this out and all that stuff." Yeah, you can do that, but out of the box is what I'm talking about.
Okay. So, the real lessons here, the tool is real and the capability is real. The underlying reality though is it's as real and as valuable as the data. There isn't any data. Nobody had any trouble in the last 23 years building a map and saying, "Let me ingest data that points to it on the map." Nobody struggled with that. What people struggled with is Palunteer is so good in the space because their data is so good, right? And then they built AI on top of the data and then they they just keep building on top of great data. That's where the lesson lies is the hype is manufactured because it can't replace Palunteer because you don't have access to Palunteer's data. Now, if you do, then yeah, it could. It probably could. It might be a little less It might be a little more clunky, a little less intuitive, things like that, but the data is the value, not the the UI, right? And so, that's one thing I want to point out. You have to know how to separate those. That's a skill that makes you junior analyst versus senior analyst is knowing, oh, this just looks cool and this is actually really valuable and how it works.
The big thing I want to talk about is the marketing myths. We see this with so many things. See this with so many freaking tools, especially with AI. Everything is the greatest tool in the world right now. AI is changing the world. It's so amazing. What's real and what's not? Know the difference. Be able to break it down. be able to go look at it and say what data are you learning or are you using in this platform and if you look at Osiris it's all public feeds which is fine that's what it's for but don't market it as a replacement for an enterprisegrade tool when it's just not because yeah you're going to get more clicks on it but you're going to get a lot of curious clicks and then you're going to see the spike go because people are like okay it was fun that's cool thanks and it is cool it is fun but I don't think it's really worth investing ing all my time into because it's going to cost me more to build this out to make it as useful as Palanteer than what Palanteer is selling right now. Um, if you don't believe me, think of how long or how much a salary is for for a security analyst or an engineer. Think of how long it's going to take them to build out. Think of all the data sources you're going to have to pay to get data sources. You're going to end up spending more. That's why Palunteer is good. That's why it's it's useful. Think of of of that.
Now, free tools. This does have value. I think it's worth bookmarking. I think it's worth getting on in the morning, opening it up and looking be like, what what's going on in the world? And I think it's gives you a decent picture. I do think that. I don't think it's something that I would go, hm, let me get all my news or let me deep dive or let me go try and figure out all the security issues by ingesting all these security feeds and put building on the map and all that stuff. I don't think so, but I do think it's valuable.
So, one thing I'm going to show you guys in the Patreon, I'm going to show a self-hosted setup where I actually ingest threat intel feeds so that you can see what that looks like and how to do that. Now, I'm going to link in the description the Osiris uh AI.live and then the GitHub where you can grab it yourself. So, hopefully this helps in the Discord. We'll chat about it. But I'm curious what your guys' thoughts are on this because I get mixed feelings on this one because did they oversell? I think they oversellled the Palunteer comparison. It does do what they say. The problem is the data is not there. So, could it do potentially? That's the thing is it's it's potentially or potentially really good out of the box not really that great. So, let me know what you guys think. Hopefully this helps you guys and let me know how you guys feel about.