H3XA — Operational Evidence

Loading the workspace.

FilterAll domainsWindow2026-10-27T21:18Z – 2026-10-28T21:18ZObservationsIncident first seenCatalogSTIX reference typesRead2026-10-28T21:18:57Z

Reference catalog

ghidra-extensions

This is a catalog row. It is not an infrastructure observation and it is not a stress event.

Type: Tool
Last seen: 2026-10-17T23:58Z
Identifier: tool--nsa-ghidra-extensions
Platforms: Not recorded

Open the full record Clear selection

These figures are the whole UTC window.

Observations0Source event time. An incident counts when first_seen falls in the UTC window.

Events0Event overlap. Counted when the stored start is at or before the window end and the last observation is at or after the window start.

Situations0Situation overlap, using the same stored start and last-observed bounds.

Assessment snapshots0Snapshot time. Counted when the derivation was stored. These snapshots do not assess source observations collected later.

Source coverageUncollectedNo overlapping source window

Catalog in window0Dated reference rows. Not infrastructure observations.

Undated catalog rows0Shelf rows with no last-seen time

Catalog shelf6497Vulnerability, campaign, and related types

AviationUnavailableOperational aviation is unavailable. No aviation source contract is enabled.

MaritimeUnavailableOperational maritime is unavailable. No maritime source contract is enabled.

Infrastructure

Observation windows

Source observations, then assessed events

Reference catalog

Catalog windows

Dated catalog rows, not infrastructure observations

Geography

Infrastructure map

Source observations Assessed situations

Markers use country centroids. They are approximate geographic representations, not measured incident coordinates.

Loading map…

Situations

Assessed situations

No assessed situation overlaps this window. That is not a statement that the period was quiet.

Coverage

Historical coverage

No stored source window overlaps this period. That is not confirmed quiet activity.

Each band is a stored collection interval. Adjacent time is not inferred continuous monitoring.

Collected, none in this window
Partial, none in this window
Failed, none in this window
Unavailable, none in this window
Uncollected

Uncollected2026-10-27T21:18Z2026-10-28T21:18Z

Stored source windows by status
Status	Stored windows
Complete	0
Partial	0
Unavailable	0
Failed	0
Uncollected	0
Source returned no rows	0

Evidence

Source observations

Catalog evidence

Reference rows in this window

No dated catalog row falls in this window. The catalog shelf count is separate, and it is not an infrastructure observation count.

Analyst context

What this view does not know

A domain filter selects a record class. It does not write a cyber, aviation, or maritime label onto an infrastructure incident.

This filter reads the threat-reference catalog. It does not query or reclassify the infrastructure incident store. The reference catalog is the STIX shelf of vulnerabilities, campaigns, and related types. Incident rows are counted only as infrastructure observations.

Operational aviation is unavailable. No aviation source contract is enabled. Operational maritime is unavailable. No maritime source contract is enabled. An empty catalog is not a quiet network.

Observations are counted by source event time: incident first_seen inside the UTC window. They are source records, not stress events.

Events and situations are counted by overlap. A stored row counts when it started at or before the window end and was last observed at or after the window start.

Assessment snapshots are counted by derivation snapshot_at, the time the derivation was stored. A snapshot in the window does not assess source observations collected later.

Observation, event, situation, assessment, map, and coverage figures are the whole window. A country selection filters only the evidence list.

Map markers use country centroids. They are approximate geographic representations, not measured incident coordinates. A country that cannot be matched is unplaced.

Aviation and maritime are not in this infrastructure read. This view does not read Harvest or Judicium. An empty domain page is unavailable data, not a quiet domain.

Coverage bands are stored collection intervals. A collected span is not continuous monitoring of the time beside it. A failed, unavailable, partial, or missing window is not confirmed quiet activity.

Operational workspace