Findings / Activity Over TimeEvent volume with weighted finding activity.
01 / INTELLIGENCE POSTURE
NOT COLLECTEDWhat deserves analyst attention?
Situational awareness over observations, findings, entity risk, cases, analytical coverage, provenance, and data health.
INGEST0normalized events
FINDINGS0analytic findings
OPEN CASES0correlated investigations
HIGH RISK0entities ≥ 70
DATA HEALTH—healthy collectors
MAX FINDING0finding score
Top Risk EntitiesEntity-level risk, not raw rule severity.
Case QueueCorrelated findings requiring investigation.
Finding DomainsWhere detections are concentrating.
Top Detection RulesRule hit distribution and noise clues.
Data HealthCollector and normalization health. Silence is not health.
02 / FINDINGS
Analytic findings
Rule-derived signals remain findings until evidence, correlation, and analyst judgment establish meaning. Score is not confidence.
| Time | Priority | Entity | Risk | Finding | Rule | Status |
|---|
03 / CASES
Case intelligence
Correlated findings, evidence, chronology, provenance, entity context, and analyst-owned interpretation.
Select a case.
No case selected.
04 / HUNT
Query normalized evidence
Search observations and findings without mutating source evidence or collapsing provenance into interpretation.
Event Histogram0 results
| Event time | Kind | Entity | Category | Title | Source |
|---|
05 / ENTITIES
Entity context and risk
Risk belongs to entities over time. It is an analytical construct, not identity, attribution, or recommendation.
| Entity | Type | Risk | Priority | Rules | Domains | Last seen |
|---|
06 / SOURCE INTELLIGENCE
External context with provenance
News and regulatory observations enrich investigations. Source context is not automatically a finding, and a finding is not a conclusion.
07 / ANALYTIC ENGINEERING
Rules, health, and noise
Detection content is versioned analytical logic. Scores express rule output, not analyst confidence or truth.
| Rule | Domain | State | Health | Hits | Last hit | Threshold |
|---|
08 / DATA HEALTH
Can the intelligence be trusted?
Collection, freshness, provenance, normalization, and errors are monitored separately from market event age and analytical conclusions.
COLLECTORS0
HEALTHY0
DEGRADED0
PARSE FAILURES0
| Source | Status | Events | Last event | Last collected | Normalized | Failures |
|---|
Retention StoreDurable local telemetry and idempotent ingest state.
INGEST RUNS0
UNIQUE EVENTS0
RAW OBJECTS0
FINDINGS0
CASES0
DATABASE0 KB