Data Points

✈️ Aircraft

An aircraft identified by tail number, ICAO hex, or registration.

Transportation

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

open →

native tool

🔧 Native workbench

Open Aircraft workbench →Advanced search →Link analysis →

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — Aircraft exploitation

Direction — frame the requirement for Aircraft: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench (open); capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Aircraft

An aircraft is identified by its tail/registration mark, ICAO 24-bit Mode-S hex address and (for airliners) an ICAO type code, broadcasting position via ADS-B. Flight tracking exposes covert flights, sanctioned jets, rendition/surveillance patterns and asset ownership behind opaque trusts.

Format: Registration: country prefix + alphanumeric (e.g. N12345 US, G-ABCD UK). ICAO 24-bit address: 6 hex chars (e.g. A12B34). Squawk: 4-digit octal (0000-7777).

📡 How it is collected

ADS-B / Mode-S receiver networks
National aircraft registries (FAA, G-INFO, etc.)
ACARS/CPDLC datalink messages
Flight-plan and NOTAM data
Photographs of registration/livery (spotter feeds)
MLAT triangulation for non-ADS-B transponders

📚 Enrichment & validation sources

FAA Registry →OpenSky Network →ADS-B Exchange →planespotters.net →ICAO hex to registration converters →OFAC SDN aircraft list →airframes.org →G-INFO (UK CAA) →

🔗 Pivot to

ICAO24 hex / registration / callsign →registered owner & operator (often trust/LLC) →airports visited (ICAO/IATA) →Image / Photograph →aircraft type/serial (MSN) →linked company / actor →

🧩 Analysis & hunting techniques

ICAO24-to-registration decoding and cross-check
Callsign vs registration mismatch detection
Pattern-of-life flight clustering (rendition/surveillance orbits)
Blocked/limited-data (LADD/PIA) circumvention via hex
Loitering/orbit geometry detection
Ownership-trust piercing
Transponder-off gap analysis
Squawk 7500/7600/7700 event flagging

🔧 Tools

ADS-B Exchange
OpenSky Network
FlightRadar24
Planespotters
dump1090
Maltego
OpenCorporates

⚡ Workbench actions

Decode ICAO24 to registration
Plot live/historical ADS-B track
Detect loiter/orbit patterns
Resolve owner/operator entity
Screen against sanctions lists
Correlate airport visits
Flag transponder gaps
Cross-reference spotter imagery

📊 Dashboard KPIs

Flights tracked (30d)Transponder-off gap eventsSanctions match statusDistinct airports visitedLoiter events detected

📂 Open

Aircraft profile →Owner actor →Sanctions screen →Link analysis →Correlate →OSINT →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook