H3XA — Operational Evidence

Loading the workspace.

FilterAll domainsWindow2026-09-28T18:09Z – 2026-10-28T18:09ZObservationsIncident first seenCatalogSTIX reference typesRead2026-10-28T18:09:00Z

These figures are the whole UTC window.

Observations276Source event time. An incident counts when first_seen falls in the UTC window.

Events106Event overlap. Counted when the stored start is at or before the window end and the last observation is at or after the window start.

Situations106Situation overlap, using the same stored start and last-observed bounds.

Assessment snapshots0Snapshot time. Counted when the derivation was stored. These snapshots do not assess source observations collected later.

Source coverageUncollectedNo overlapping source window

Catalog in window682Dated reference rows. Not infrastructure observations.

Undated catalog rows0Shelf rows with no last-seen time

Catalog shelf6497Vulnerability, campaign, and related types

AviationUnavailableOperational aviation is unavailable. No aviation source contract is enabled.

MaritimeUnavailableOperational maritime is unavailable. No maritime source contract is enabled.

Infrastructure

Observation windows

Source observations, then assessed events

Reference catalog

Catalog windows

Dated catalog rows, not infrastructure observations

Geography

Infrastructure map

Source observations Assessed situations

Markers use country centroids. They are approximate geographic representations, not measured incident coordinates.

Loading map…

Catalog evidence

Reference rows in this window

Dated reference-catalog rows in the selected window
Last seen	Type	Name	Identifier
2026-10-17T23:58Z	Tool	dnf-model-counting	NationalSecurityAgency/dnf-model-counting
2026-10-17T23:58Z	Tool	Foundation	NationalSecurityAgency/Foundation
2026-10-17T23:58Z	Tool	openflame	NationalSecurityAgency/openflame
2026-10-17T23:58Z	Tool	ghidra-lisa	NationalSecurityAgency/ghidra-lisa
2026-10-17T23:58Z	Tool	seabee	NationalSecurityAgency/seabee
2026-10-17T23:58Z	Tool	datawave-accumulo-plugins	NationalSecurityAgency/datawave-accumulo-plugins
2026-10-17T23:58Z	Tool	datawave-map-service	NationalSecurityAgency/datawave-map-service
2026-10-17T23:58Z	Tool	datawave-file-provider-service	NationalSecurityAgency/datawave-file-provider-service
2026-10-17T23:58Z	Tool	.github	NationalSecurityAgency/.github
2026-10-17T23:58Z

Analyst context

What this view does not know

A domain filter selects a record class. It does not write a cyber, aviation, or maritime label onto an infrastructure incident.

This filter reads the threat-reference catalog. It does not query or reclassify the infrastructure incident store. The reference catalog is the STIX shelf of vulnerabilities, campaigns, and related types. Incident rows are counted only as infrastructure observations.

Operational aviation is unavailable. No aviation source contract is enabled. Operational maritime is unavailable. No maritime source contract is enabled. An empty catalog is not a quiet network.

Observations are counted by source event time: incident first_seen inside the UTC window. They are source records, not stress events.

Events and situations are counted by overlap. A stored row counts when it started at or before the window end and was last observed at or after the window start.

Assessment snapshots are counted by derivation snapshot_at, the time the derivation was stored. A snapshot in the window does not assess source observations collected later.

Observation, event, situation, assessment, map, and coverage figures are the whole window. A country selection filters only the evidence list.

Map markers use country centroids. They are approximate geographic representations, not measured incident coordinates. A country that cannot be matched is unplaced.

Aviation and maritime are not in this infrastructure read. This view does not read Harvest or Judicium. An empty domain page is unavailable data, not a quiet domain.

Coverage bands are stored collection intervals. A collected span is not continuous monitoring of the time beside it. A failed, unavailable, partial, or missing window is not confirmed quiet activity.

Situations

Assessed situations

Assessed situations that overlap this UTC window
Situation	Place	Status	Events
Internet disruption in PA	PA	active	4
Internet disruption in KZ	KZ	active	1
Internet disruption in UA	UA	active	20
Internet disruption in HT	HT	active	1
Internet disruption in GH	GH	active	1
Internet disruption in CY	CY	active	1
Internet disruption in CO	CO	active	23
Internet disruption in MW	MW	active	1
Internet disruption in BT	BT	active	1
Internet disruption in CD	CD	active	1
Internet disruption in FR	FR	active	4
Internet disruption in MF	MF	active	1
Internet disruption in BD	BD	active	4
Internet disruption in AF	AF	active	1
Internet disruption in KW	KW	active	1
Internet disruption in BZ	BZ	active	1
Internet disruption in UG	UG	active	3
Internet disruption in NG	NG	active	3
Internet disruption in PE	PE	active	7
Internet disruption in BO	BO	active	4
Internet disruption in RU	RU	active	33
Internet disruption in GB	GB	active	196
Internet disruption in EG	EG	active	1
Internet disruption in AR	AR	active	7
Internet disruption in BW	BW	active	5
Internet disruption in VE	VE	active	4
Internet disruption in BJ	BJ	active	1
Internet disruption in LA	LA	active	1
Internet disruption in AZ	AZ	resolved	1
Internet disruption in SI	SI	resolved	1
Internet disruption in BI	BI	resolved	1
Internet disruption in KH	KH	resolved	4
Internet disruption in RO	RO	resolved	3
Internet disruption in SC	SC	resolved	1
Internet disruption in IN	IN	resolved	20
Internet disruption in DO	DO	resolved	1
Internet disruption in TL	TL	resolved	1
Internet disruption in LB	LB	resolved	1
Internet disruption in TJ	TJ	resolved	3
Internet disruption in MT	MT	resolved	1
Internet disruption in CM	CM	resolved	1
Internet disruption in PW	PW	resolved	1
Internet disruption in NL	NL	resolved	28
Internet disruption in PH	PH	resolved	8
Internet disruption in MX	MX	resolved	10
Internet disruption in ET	ET	resolved	1
Internet disruption in TZ	TZ	resolved	1
Internet disruption in MM	MM	resolved	7
Internet disruption in GT	GT	resolved	4
Internet disruption in IR	IR	resolved	17
Internet disruption in CV	CV	resolved	4
Internet disruption in RS	RS	resolved	1
Internet disruption in US	US	resolved	318
Internet disruption in IT	IT	resolved	26
Internet disruption in OM	OM	resolved	4
Internet disruption in CN	CN	resolved	36
Internet disruption in BY	BY	resolved	1
Internet disruption in CU	CU	resolved	1
Internet disruption in SN	SN	resolved	1
Internet disruption in TN	TN	resolved	1
Internet disruption in AE	AE	resolved	1
Internet disruption in VN	VN	resolved	1
Internet disruption in PK	PK	resolved	9
Internet disruption in LY	LY	resolved	1
Internet disruption in HK	HK	resolved	29
Internet disruption in SK	SK	resolved	1
Internet disruption in AO	AO	resolved	1
Internet disruption in ZW	ZW	resolved	1
Internet disruption in SY	SY	resolved	1
Internet disruption in MK	MK	resolved	1
Internet disruption in AM	AM	resolved	4
Internet disruption in CK	CK	resolved	1
Internet disruption in UZ	UZ	resolved	1
Internet disruption in MA	MA	resolved	1
Internet disruption in RW	RW	resolved	1
Internet disruption in MN	MN	resolved	1
Internet disruption in HN	HN	resolved	4
Internet disruption in JM	JM	resolved	1
Internet disruption in IQ	IQ	resolved	1
Internet disruption in EC	EC	resolved	1
Internet disruption in PL	PL	resolved	15
Internet disruption in IE	IE	resolved	7
Internet disruption in SZ	SZ	resolved	1
Internet disruption in LT	LT	resolved	7
Internet disruption in DZ	DZ	resolved	1
Internet disruption in PY	PY	resolved	3
Internet disruption in SA	SA	resolved	4
Internet disruption in QA	QA	resolved	1
Internet disruption in BH	BH	resolved	1
Internet disruption in JO	JO	resolved	1
Internet disruption in SG	SG	resolved	6
Internet disruption in MY	MY	resolved	5
Internet disruption in ID	ID	resolved	15
Internet disruption in TH	TH	resolved	40
Internet disruption in TR	TR	resolved	12
Internet disruption in GR	GR	resolved	1
Internet disruption in SS	SS	resolved	1
Internet disruption in PT	PT	resolved	1
Internet disruption in NI	NI	resolved	1
Internet disruption in SO	SO	resolved	1

Coverage

Historical coverage

No stored source window overlaps this period. That is not confirmed quiet activity.

Each band is a stored collection interval. Adjacent time is not inferred continuous monitoring.

Collected, none in this window
Partial, none in this window
Failed, none in this window
Unavailable, none in this window
Uncollected

Uncollected2026-09-28T18:09Z2026-10-28T18:09Z

Stored source windows by status
Status	Stored windows
Complete	0
Partial	0
Unavailable	0
Failed	0
Uncollected	0
Source returned no rows	0

Evidence

Source observations

Evidence country

Evidence 81–120 of 276. Ordered by source event time, then identifier. The observation count stays the whole window.

Source evidence for infrastructure observations
Event time	Collected	Source	Native identifier
2026-10-02T00:00Z	2026-10-03T04:38Z	voidly-atlas	CN-2026-0624
2026-10-02T00:00Z	2026-10-03T04:38Z	voidly-atlas	LB-2026-1232
2026-10-02T00:00Z	2026-10-03T04:38Z	voidly-atlas	AZ-2026-1649
2026-10-02T00:00Z	2026-10-03T04:38Z	voidly-atlas	IR-2026-2495
2026-10-02T00:00Z	2026-10-03T04:38Z	voidly-atlas	OM-2026-1197
2026-10-01T23:30Z	2026-10-02T00:03Z	voidly-atlas	HK-2026-0082
2026-10-01T23:15Z	2026-10-02T00:03Z	voidly-atlas	SK-2026-0010
2026-10-01T23:10Z	2026-10-02T00:03Z	voidly-atlas	UA-2026-0176
2026-10-01T22:20Z	2026-10-02T00:03Z	voidly-atlas	IN-2026-0517

Operational workspace