Stories & analysis
Editorial essays. They are written interpretation, not a query of the live corpus. Where a chart appears, it is labeled as illustrative.
Start with a place and a time
H3XA is read from a geography and a window. The situation is the record you can return to. The history behind it stays open.
ExplainerThe record and the setting
One place and one month open one situation. The infrastructure record is what H3XA derives. Air, the catalog, and everything nearby stay in the setting.
ExplainerReading cross-domain convergence
How to distinguish coincident observations from a pattern that deserves deeper investigation across cyber and air domains.
Research briefWhat deserves attention in a live picture
A practical framework for moving from a high-volume feed to an evidence-backed analytical priority.
ExplainerReading internet disruptions as geopolitical signal
Why deliberate network shutdowns and connectivity collapses are observable evidence of state action, and how to separate an outage from a shutdown.
ExplainerThe AI/ML threat landscape in H3XA
How adversarial machine-learning techniques are organized, and why AI systems need their own threat taxonomy.
Trend analysisExploited vulnerabilities are the signal
CISA's Known Exploited Vulnerabilities catalog separates the vulnerabilities attackers actually use from the long tail of theoretical CVEs.
Regional analysisWhere connectivity is being withheld
Internet shutdowns cluster geographically. Understanding the regional pattern explains why a shutdown happens and what it signals.
TimelineAnatomy of a shutdown
A representative timeline of how a deliberate internet restriction unfolds, from pre-event baseline to restoration.
Research briefHow to read a threat-intelligence graph
STIX objects and relationships are the backbone of H3XA's cyber layer. Here is what they mean and how to move through them.
Research briefWho H3XA is for
The people and decisions H3XA is built to serve, and the business case that makes a provenance-first operational picture worth paying for.
ReferenceWindows commands abused by attackers
A JPCERT/CC reference of the built-in Windows commands attackers most often use during intrusions, organized by the phase of compromise.