AAVA

Loading… connecting

play_circle Watch the walkthrough

account_tree corporate_fare folder_data

scatter_plot hub

account_tree view_stream

Search

Investigation view

Relation family · edges

Evidence strength · edges

Hard Medium Weak

Event type

ads_click

Select a group or event

Choose a point, group, or relation on the canvas to inspect its details here.

account_tree

Select a person

Pick an event, group, or actor on the canvas to see where they sit in the org chart.

legend_toggle Visual key

★Anomalous post - dark-red star Worm artifact - special-case file family (orange diamond) Self-replication loop - background tasking loop File-backed post - post published from a staged file ↳Instruction relay - queued read_file instruction hop Protected / interrupted - publication stopped by the gate (green ring) Not stopped - file-backed post still reaches SaidIT despite the placed gate (red ring) Hovered / focused mark (a selected mark gets an ink ring) Hard cross-stage relation 3Merged group - takes its lane's stage color scheduletenant local time

layers Stages

Control Comm Files Preflight Publish Cleanup Context

bolt Evidence strength

Hard - deterministic links: shared artifact lifecycle (create→read→delete of one file), verified queue lineage (worm_relay, queue_to_child_*), preflight→post pairs.

Medium - strong temporal/schema inference: same actor + same context inside a tight window (assign_to_exec, virus_iteration, email_delivery).

Weak - contextual proximity only; hidden by default and never used for incident chains.

schema Stage Analytics

Stage view ready

view_in_ar 3D Analytics