Loading… connecting
account_tree view_stream
account_tree view_stream

Search

search

Investigation view

Relation family · edges

Evidence strength · edges

Event type

ads_click

Select a group or event

Choose a point, group, or relation on the canvas to inspect its details here.

account_tree

Select a person

Pick an event, group, or actor on the canvas to see where they sit in the org chart.

legend_toggle Visual key
★Anomalous post (dark-red star) Special case / worm artifact (orange diamond) Self-replication loop Selected / focused mark Hard cross-stage relation 3Merged group - takes its lane's stage color scheduleTT = tenant local (UTC-7)
Control Comm Files Preflight Publish Cleanup Context

Evidence strength

Hard - deterministic links: shared artifact lifecycle (create→read→delete of one file), verified queue lineage (worm_relay, queue_to_child_*), preflight→post pairs.

Medium - strong temporal/schema inference: same actor + same context inside a tight window (assign_to_exec, virus_iteration, email_delivery).

Weak - contextual proximity only; hidden by default and never used for incident chains.

schema Stage Analytics
Stage view ready
view_in_ar 3D Analytics
-
drag_indicator Events in window