Data Points

🏭 Facility / Site

A physical installation — plant, base, port, data centre — with a fixed footprint and function.

Geospatial

Sources

0 no-auth

Disciplines

that use it

Mission domains

reach

Workbench

—

native tool

🔗 Analyst pivots

Search platform →OSINT pivot →Source catalog →

🔍 Lookup

📜 Playbook — Facility / Site exploitation

Direction — frame the requirement for Facility / Site: what decision does this support, by when?
Collection — pull the 0 mapped sources (0 free) and the native workbench; capture provenance and observe OPSEC.
Processing — normalize, de-duplicate and enrich the collected data.
Analysis — correlate against local holdings; apply ACH; assign confidence.
Dissemination — open a case, draft a report, share via STIX/MISP.
Feedback — set an alert rule / watchlist to monitor for change.

⚡ AI Skills & Automation

🤖 Copilot brief ⚡ AI Skills Resolve Enrich Auto-Collect Hunt Report Export

Automate unattended via the cron pipeline (collect → ingest → resolve → enrich → score → alert).

🗃 Data Management

+ Case + Campaign Watchlist Tag Save search Whitelist Export STIX/MISP Report

🧩 Advanced Capabilities

Link Analysis Pivot Explorer Timeline Threat Hunting Analytics Detection Rules Blockchain OSINT Pivot Passive DNS TAXII 2.1 MISP Feed Create Alert Rule NetFlow Coverage & Gaps

✨ Enrichment pathways

Enrichment Runner →Resolve locally →Enrichment → local →Integrations →

🎫 Facility / Site

A facility is a fixed physical site such as a factory, port, warehouse, military base, refinery, or data center, with a footprint, function, and operator. It matters because facilities are chokepoints in supply chains and networks, and their status, ownership, and activity reveal capacity, intent, and connections.

Format: Site record: name, operator, function/type, coordinate/bounding polygon, address, and codes (UN/LOCODE for ports, ICAO/IATA for airfields, EIA/plant IDs, OSM way/relation ID).

📡 How it is collected

OSM feature and building-footprint extraction
Satellite/aerial imagery interpretation
Corporate filings and asset disclosures
Trade and shipping port references
Permit, environmental, and regulatory registries
Ground-level and social-media imagery

📚 Enrichment & validation sources

OpenStreetMap / Overpass API →OpenInfraMap →Global Energy Monitor →Wikidata →GeoNames →Copernicus Sentinel Hub →UN/LOCODE →OpenCorporates →

🔗 Pivot to

GPS Coordinates →Satellite Imagery →Location / Coordinates →operator / actor-profile →Shipment / Bill of Lading →Sanction / Watchlist Entry →country-dashboard →

🧩 Analysis & hunting techniques

Footprint digitization and area estimation
Change detection across imagery dates
Function classification from morphology
Ownership/operator attribution
Throughput and capacity estimation
Co-location and supply-chain linking
Activity monitoring (vehicles, storage, flares)
Pattern-of-life over time series

🔧 Tools

QGIS
Overpass Turbo
Google Earth Pro
Sentinel Hub EO Browser
GDAL/OGR
PostGIS
Maxar Open Data viewer
OpenInfraMap

⚡ Workbench actions

Digitize site footprint
Run imagery change detection
Classify facility function
Attribute operator/owner
Estimate capacity/throughput
Screen operator against sanctions
Link to inbound/outbound shipments
Export site dossier

📊 Dashboard KPIs

Footprint areaLast imagery dateDetected activity levelLinked shipments countOperator sanctions flag

📂 Open

Data point profile →Facility profile →Satellite imagery →Shipment tracking →Sanctions screening →Link analysis →

Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports

🤖 AI Copilot

Cron: 0 * * * * php /home/zaptf0zdggll/public_html/threats/cron.php

📜 Playbook

Open Response Playbook