3D / 4D AI VISUALIZATION · LOCAL GRAPH STORE
Open graph workspace →SECURITY OPERATIONS · SIGN IN REQUIRED · INVENTORY UNKNOWN API status checking
OCDC operations
Decision-focused overview across security, OT, investigations, analytics, and platform readiness. Every count names its source state; unknown is never shown as zero.
Local visualization · current limits and saved view settings
This OCDC visualization is not a live vendor feed; analyst review is required. Your dashboard layout (visible panels, order, expanded and pinned workspaces, perspective, density, skin and 2D/3D/4D default) is saved to your account on this OCDC server and cached in this browser; dashboard and simulator drill paths stay in this browser profile. Drill paths store record identifiers and reload details from the active tenant; they do not copy tenant record content into browser storage. The local server defaults to a loopback bind and one process. This build does not establish production tenant isolation, active provider feeds, or AI model capability beyond what the code implements. In the relationship view, “3D” is a rotatable perspective projection; “4D” is recorded observation time that can be scrubbed or played.
Open alerts—Unknown · waiting for tenant alerts
Critical alerts—Unresolved · analyst review
Incidents—Cases in this workspace · view all
Verified API connectionsUnknownSource freshness unknown · tenant-record coverage unknown
Local dataset rows—Stored tenant rows · provenance retained
OSINT source records—Local captures · review required
Local graph nodes—Local links · source families may overlap
HOME
Start here
What needs you now, what you pinned, and your areas of OCDC with similar screens folded together.
Needs your attention
Sign in to see what needs you.
Pinned
Nothing pinned yet. Pin any screen with ☆ beside it in the sidebar.
Your areas
Similar screens, folded together. Open an area to see its screens in the sidebar.
Recently used
Nothing yet. The places you open appear here.
Your start page board
Drag, resize, add or remove tiles, or switch to another role’s start page. Every widget, 3D and 4D view and simulator can be added here.
Counts come from this tenant’s records for your role; a dash means the number could not be read, never zero.MAIN DISPLAY · LIVE VIEWS OVER THIS TENANT
Relationships, telemetry and AI activity
The tenant graph, spatial and time telemetry, and AI security events. Use 2D / 3D / 4D in the header, expand any view for detail, or open its workspace for the full data.
MANAGEMENT DASHBOARD · ALWAYS 3D / 4D
Management KPI field
SOC / 3D-IC EXPLORATION · SYNTHETIC SAMPLE
Spatial and time telemetry
AI SECURITY OPERATIONS · TENANT TELEMETRY
Open AI SOC workspace →AI events, anomalies and candidates
360° VIEWS · EVERY SOURCE JOINED
360° views
One page for each customer, solution, product, service and industry: risks, cases and alerts, assets and places, compliance, contracts and SLAs, operations, imported tables and open data, with forecasts beside history. Every number opens its rows. Drag, resize and share it like any board.
PRIMARY · SOC · INDUSTRY · PRODUCT DASHBOARDS
OCDC dashboards
One primary view across OCDC SOC, industry, and product domains, with dedicated views for every operating area. Every count names its tenant record family and whether it is local or unknown; synthetic rows are counted apart. Each view has its own 2D plan, 3D projection, and 4D time replay, driven by the shared dimension switch and cursor.
Dashboard data loads from the authenticated OCDC server. If this page was opened as a file, use the local server link above.
SYNTHETIC LAB · INTEGRATED DASHBOARD
Traffic simulator
Explore generated network, endpoint, OT/ICS, automotive and AI telemetry in this dashboard. All simulator records are synthetic and remain separate from tenant data unless an operator explicitly uses the simulator's push tool.
Starting the traffic simulator…
SOURCE & DATA REALITY
Open source and provenance profile ↗What this dashboard is showing
Current tenant records are not proof of a live provider feed. Counts are source-family rows and may overlap.
Recently verified API connectionsUnknownSource freshness; independent of stored records
Configured · unverifiedUnknownNot represented as live
Imported recordsUnknownExplicit import provenance; not a live feed
Demo / synthetic recordsUnknownExplicitly flagged samples
Other local recordsUnknownNot classified as imported or synthetic; source-family rows
Tenant source-family rowsUnknownLocal record inventory; rows may overlap across families
Waiting for the tenant analytics inventory. Unknown values are not treated as zero.
ALL DATA · LOCAL TENANT SCOPE
One workspace, role-focused views
See the OCDC data families together, then switch the overview to a role-focused lens. Counts come from this tenant’s local records.
Loading tenant inventoryTenant inventory not yet refreshed
OCDC DATA UNIVERSEPerspective view · source families stay distinct
OCDC
LOCAL TENANT DATALoading source-family counts…
Local records · imported and submitted sourcesNo totals are combined across domains until their overlap is understood.
INDUSTRY SOLUTIONSSeven industry views
Architecture map · no industry feed is impliedOCDC SERVICE FABRIC · TENANT WORKSPACES
Loading tenant feedServices, solutions & industry dashboards
Local OCDC service and solution views roll up to this platform overview. Open a workspace to reach its records, analysis, workflows, and clearly labeled test data.
Loading service and industry dashboards…
Tenant and feed boundaryLoading tenant scope and data-source status…
SOURCE ANALYSIS · RELATIONSHIP SIGNALS
Open OSINT register ↗Data connections & analysis
Counts and links below are computed from tenant-scoped OSINT records and the current local graph.
Most represented source hostsUnknown hosts
Most connected entitiesUnknown graph links
Sign in to load tenant graph records.
CONNECTED DATA · USE CASE COVERAGE
Explore data relationships ↗Use cases, sources & analysis
Current tenant inventory snapshot, not proof of a live provider feed. Source families may overlap; Drive, mailbox, and GA4 counts reflect only data imported for this workspace.
SECURITY OPERATIONSUnknownCounts load from authenticated tenant APIs
INVESTIGATIONS & FORENSICSUnknownCounts load from authenticated tenant APIs
OSINT & WEB SOURCESUnknownCounts load from authenticated tenant APIs
AMATEUR RADIO ACTIVITYUnknownNG3K feed status loads separately
FINANCIAL REVIEWUnknownCounts load from authenticated tenant APIs
AI & DATA GOVERNANCEUnknownCounts load from authenticated tenant APIs
OT & SUPPLY CHAINUnknownCounts load from authenticated tenant APIs
AUTOMOTIVE & MOBILITYUnknownCounts load from authenticated tenant APIs
GOOGLE DRIVEUnknownChecking connection and imports…
GMAILUnknownChecking connection and imports…
GOOGLE ANALYTICS 4UnknownAggregated sessions · channel · events
threat-sharing platform THREAT INTELLIGENCEUnknownthreat-sharing platform connection and imported indicators load separately
LIVE OPERATIONS & CONNECTORSUnknownWaiting for the authenticated operations snapshot
REGULATED INDUSTRY PLAYBOOKS7 deployment templatesFinancial services · public sector · healthcare · life sciences · insurance · manufacturing · automotive
IDENTITY & CLOUD ACCESSUnknownCounts load from authenticated tenant APIs
ENDPOINT RESPONSEUnknownCounts load from authenticated tenant APIs
SUPPLIER VULNERABILITY REVIEWUnknownCounts load from authenticated tenant APIs
PRIVACY & DATA LOSS CONTROLUnknownCounts load from authenticated tenant APIs
PUBLIC DATA CATALOG · RESEARCH REVIEWED 18 OCT 2026
Open local data intake ↗Use cases & public data sources
Source-backed OCDC workflow ideas with open, free-tier, community, and research datasets or APIs. Catalogued does not mean connected: imported records, live verification, credential requirements, research restrictions, and terms review are shown separately.
Mapped use casesLoading…
Reviewed public sourcesLoading…
Loading source state…
Loading use cases…
Loading public data source catalog…
AMATEUR RADIO SOURCES · SEPARATE FROM CYBER THREAT INTEL
DX activity and propagation sources
OCDC fetches NG3K’s published DXpedition RSS feed on demand and stores limited metadata for this tenant. The displayed retrieval time is when OCDC fetched the snapshot; the publisher’s last content update and whether an event is still active are not independently verified. Check event windows at the linked source. PropMagic Suite and OtaMagic are linked as external references; their live telemetry and radar data are not imported.
NG3K not synced
DXpedition feed has not been synced.
Feed scope: up to 100 announced and upcoming DXpedition entries; title, source link, feed date, and category only. Manually added Unicorns store a callsign and grid as reference targets only; they are not monitored. Contest entries are not fetched because WA7BNM feed terms limit reuse. Live cluster spots, spotter maps, and VOACAP calculations are not connected because OCDC has no documented authorized API for them. PropMagic Suite is linked for its advertised space-weather and propagation views. OtaMagic’s in-app advisory says its third-party overlays are for personal, non-commercial amateur-radio use, so OCDC links to the radar without copying or ingesting those records. No signals are transmitted.
LOCAL SYNTHETIC SAMPLE · SoC / 3D-IC EXPLORATION
Spatial and time telemetry explorer
Choose a recorded sample time to compare illustrative temperature, power, voltage, and workload across three die layers.
Loading local synthetic sample…
Visualization is a 2D isometric SVG projection of x/y cells separated by z-layer and selected timestamp; it is not a 3D physical model or EDA simulation. The sample is deterministic synthetic data, not live telemetry, calibrated prediction, AI output, or chip-safety evidence.
OPERATIONS THEATRE · LOCAL GRAPH VIEW · SVG DEPTH CUES + TIMELINE
Threat activity graph (time-filtered)
Select a node to focus its neighborhood, inspect provenance, and open its case, alert, or source workflow. The timeline uses available timestamps; sample records stay labeled.
Loading OCDC graphOpen native graph ↗
LOCAL GRAPH COVERAGE
Counts reflect graph-linked records and can overlap. A zero means no graph match, not that a platform source has no data. Select a row to filter the graph.Explore records by domain
Loading graph coverage…
Graph record index
Record count unknownThe scene labels 12 priority records for quick scanning. Browse the complete graph record index here; select any record to focus its neighborhood and inspect the full object fields.
Loading graph records…
EVENT TIME SCRUBBERAll available eventsLoading event timestamps…
LOCAL VIEWEarlierLatest available
SOC COMMAND SNAPSHOT · CURRENT TENANT
Attention & response
Start with unresolved alerts, then open the case or evidence behind each group. No composite security score is inferred.
Loading active alert context…Local tenant records
AI COPILOT · EVIDENCE-BOUNDED
Review the highest-priority open alert
Uses one current alert and the configured OCDC model mode. Source evidence stays available for analyst review.
Copilot has not analyzed an alert in this view yet. Run an advisory analysis to see its evidence and recommended next step.
Copilot · local rules (LLM off)Suggests; analyst decides
Supervised actionRequires separate authorization
Full autonomyNot used for security response
Grouped alert queue
Related alerts are grouped only when a case explicitly links them. Priority uses supplied severity, then oldest supplied timestamp; missing times stay unknown. Exploitability and business asset value are not consistently available.
Loading active alert groups…
OCDC CORE ENGINE · EVENT-DRIVEN OPERATIONS
Live data, incidents & workflows
Retrieve fresh OCDC context, correlate alerts with OT and endpoint records, and run reviewable multi-step workflows. Live status reflects events received by this OCDC instance.
MULTI-STEP WORKFLOWSRun a reviewed operations workflow
Local OCDC records onlyChoose a workflow to see its available records and scope.
Loading workflow definitions…
REGULATED INDUSTRIESDeployment playbook templates
6 sectors · connectors require configurationLoading industry templates…
ADMIN · SINGLE-USE APPROVALSWorkflow approvals
—Approvals load for tenant administrators.
No approvals loaded.
ADMIN · RETENTIONLegal holds
—Legal holds load from the tenant record.
No legal holds loaded.
TAMPER EVIDENCEChain integrity
Local HMAC chainsRun a verification to see verified, legacy and broken entry counts.
Real-time boundaryOCDC updates this dashboard as authenticated CloudEvents arrive and local workflows complete. Vendor API polling, database drivers, SCADA writes, network remediation, on-call paging, and live directory risk scoring are not configured here. Only integrations marked configured in the connector panel have local credentials/configuration.
P2–P6 · FORENSIC EVIDENCE CONSOLE
Forensic signal board
Drill from this overview into source-submitted records, case evidence, OT telemetry, and point-in-time manifest metadata.
Loading tenant-scoped forensic counts…
CASE EVIDENCERecent evidence records
Open case workbench ↗Loading evidence metadata…
ENDPOINTRecent observations
Open endpoint review ↗Loading endpoint metadata…
HOST MANIFESTSRecent manifest metadata
Open manifest history ↗Loading manifest metadata…
OT / TRANSPORTRecent asset observations
Open telemetry workspace ↗Loading read-only telemetry…
LOCAL DETECTOR · DETERMINISTIC RULES
Loading detector statusMemory-capture activity review
Checks source-submitted endpoint event summaries for reported memory-capture activity. No RAM is collected, read, or parsed.
Loading the tenant-scoped detector snapshot…
Loading source event matches…
CAPABILITY STATUSWhat this OCDC build can inspect today
Local build · states reflect available data paths, not vendor claimsEvidence boundaryCounts and details come from this local tenant. Imports are source-submitted or analyst-supplied. This view does not acquire devices, parse raw disk or memory images, crawl social platforms, identify people, or establish legal authority or hardware attestation.
FORENSICS · SNAPSHOT TIMELINE
Time-travel forensics
Move through each host's snapshots in time: the state at any moment, what changed between two moments, and custody checks on stored content.
PHYSICAL AI · COVERAGE-DRIVEN VERIFICATION
Scenario verification
Describe a scenario family in an OpenSCENARIO DSL subset, run it in the Drive Sim until coverage closes, then triage failures, compare runs and gate releases.
DIGITAL TRUST · RISK DECISIONING
Fraud rules & decisioning
Write scoring, velocity and approve / review / decline rules, backtest them on stored events with precision and recall, and check e-mail, phone, IP and user-agent signals offline.
OCDC PLATFORM · NATIVE CAPABILITIES
OCDC capabilities
Identity, cloud, exposure, automation, data, AI, fraud, crypto, assurance and compliance capabilities built into OCDC, each with its live summary.
BRAIN · DAILY GAPS & CLIENT NEEDS
Platform improvement
What OCDC is missing, what clients ask for and where the market is moving, across every industry, from the Brain's daily scan.
P2–P7 · AI SECURITY + FINANCIAL CRIME
Unified intelligence overview
See AI activity, data readiness, and linked financial patterns from approved local OCDC records.
Loading local inventoryOpen native graph ↗
AI inventory records0Explicitly identified in imported recordsAI discovery connectors0Imported, configured, and local discovery sources
OCDC SIGNAL GRAPH · LOCAL RECORDSAI across the enterprise
GenAI · agents · development environments · Shadow AI
AI TIME CURSOR
EarlierImported record windowLatest
Visual sweep only · timestamped AI event playback is not available from current records.
COVERAGE VIEW
AI visibility needs source data
OCDC is ready to classify explicitly supplied AI inventory and development events. There is no provider discovery connector in this local workspace, so zero observed records does not mean zero AI usage.
LOCAL CONNECTOR · P2 INTAKE · P5 GRAPH + VECTORIZATION
Docker Desktop AI discovery
Find AI runtime and development-environment candidates in the active local Docker context. A name or image match is a review signal, not proof of AI use.
Checking local Docker EngineActive context not yet verifiedNo inventory snapshot
CONTAINERS—
AI CANDIDATES—
EXPOSURE REVIEW—
IMAGES · NETWORKS · VOLUMES—
Refresh to read metadata from Docker Desktop.
Searches local metadata by name or image. Select a result to inspect its state and published-port metadata.
Refresh to index the current Docker inventory.
Metadata only: names, image references, container state, published-port metadata, and aggregate resource counts. OCDC does not read environment variables, credentials, labels, mounts, logs, image layers, volume contents, or network payloads.
AI agents & GenAI controlsModel settings · prompt/data boundary · human review →Low-code & high-code postureEntitlements · public exposure · anomalous development events →Graph Decision IntelligenceConnect identities, AI tools, datasets, alerts, and cases →
Open OCDC import fields and P1–P7 mapping ↗
P2 CLASSIFY · P5 GATE · P4 REVIEW
Protect the data behind AI
Imported dataset headers are scanned for sensitive-field indicators. A local classical trainer is available only for allowlisted technical metadata after an administrator records an owner authorization reference.
0datasets flagged for review
Loading dataset safety summary…
Safe-to-train policy stateNo dataset is approved by default. The local classical trainer uses only explicit tenant administrator submissions; imported rows are not automatically sent to a hosted LLM.Open data governance →
P2 INGEST · P5 CORRELATION · P6 CASE REVIEW
Trace in native graph ↗OCDC Fraud Prevention & AML Review
Unify imported transaction patterns, provider-reported screening results, and explicit OCDC case context in one analyst workflow. Findings remain review leads, not decisions.
OCDC CROSS-SECTOR PRODUCT · LOCAL SOURCE-BACKED REVIEW
Fraud & AML review queue
Use declared sector context for financial services, public sector, healthcare, life sciences, insurance, manufacturing, and mobility. Exact normalized identifier and explicit case-ID joins only. Imported source claims retain provenance and require analyst verification.
Loading tenant fraud and AML coverage…
Declared sector coverage · counts show imported transaction rows only
Checking tenant sector tags…
Zero means no transaction row is currently imported with that sector tag. It does not mean there is no risk.
Checking event intake, source freshness, and payment-stream status…
Loading source-backed review items…
A no-candidate result is not an assurance of no fraud or sanctions exposure. OCDC does not currently connect to a bank/payment authorization stream, independently verify watchlists, block transactions, or generate SAR/legal conclusions.
Transaction rows ready0Amount + account or wallet key
Wallet identifiers0Explicit wallet fields only
Last scan candidates—Run a local scenario scan
Connected providers0No provider connection verified
SMART CRYPTO & CONTRACT ANALYTICS · P4
Loading local dataset profileImported chain evidence
Explore transaction, contract, bridge-reference and provenance coverage from the current tenant’s imported dataset rows.
Loading crypto dataset profile…
Observed chain coverageClick a chain to inspect its imported row references
No matching imports loaded.
Imported activity timelineExplicit timestamps · UTC · record count only
No timestamped crypto rows loaded.
Cross-chain bridge-reference candidatesGrouped only when the imported rows share a bridge reference and explicit chain values
No multi-chain bridge-reference groups observed.
Source-reported attribution claimsProvider or analyst labels · not independently verified
No explicit source labels in imported rows.
LOCAL INVESTIGATION · IMPORTED ROWS ONLY
Ready · local data onlyDirected transfer pathfinder
Find source-to-target paths in imported transfer rows. Paths stay within an explicitly named chain and retain every supporting row reference.
Enter exact identifiers to search tenant-local imported transfers. No network query will be sent.
This is a bounded row-path search, not a chain indexer, entity attribution, cross-chain bridge trace, or proof of funds continuity. A missing path means no matching path in the rows scanned.
TYPED INTAKE · TENANT-SCOPED
Provider connections and imported records
Connection checks and local export imports have separate status and counts. An imported file never marks a vendor as connected.
Loading provider connection and import states separately…
Checking connector and import status…
Provider credentials and live API access are not configured. Operator authorization references are retained as claims and are not independently verified.
LIVE READ-ONLY SOURCES
Checking live source statusBlockchain.com Explorer + Etherscan V2
Check latest-block reachability or query one address and one bounded page. Credentials stay in server environment variables.
Loading live provider configuration…
A successful check confirms only provider API reachability. Query results are provider-submitted evidence; OCDC does not verify address ownership, attribution, sanctions status, or transaction intent. No signing, transfer, freeze, or blockchain write action is available. Etherscan data: Powered by Etherscan.io APIs.
ARKHAM INTELLIGENCE · MANUAL READ-ONLY QUERIES
LoadingArkham intelligence workspace
Run one approved search, address, entity, tag, account-analytics, or batch-risk request. No Arkham query runs when this dashboard loads. Connector notes ↗
Checking server-side credential and tenant query history…
No Arkham query results loaded.
Provider output is stored as tenant-scoped, provider-reported-unverified evidence. Risk labels, entity names, and address intelligence are not OCDC-verified identity or sanctions findings. Results do not trigger alerts, transactions, freezes, or enforcement actions.
Loading analytics method readiness…
Local imported records only. No chain node, provider attribution, identity resolution, validated forecast, asset freeze, transfer block, or legal conclusion is connected.
Scenario thresholdsAdjustable local review settings · not regulatory thresholds
Import transaction rows with timestamps and explicit account or wallet fields, then run a scenario scan.
Structuring / smurfing threshold required
Repeated same-account transactions at or below a value ceiling that an authorized analyst configures for the applicable policy and currency.
Layering / fund movement wallet path
Trace directed wallet-to-wallet transfers from explicit source and destination fields, transaction hashes, chain labels, and row provenance.
Pass-through activity direction + time
Find incoming and outgoing activity for one explicit account within the configured rolling window.
Velocity & shared infrastructure configurable
Surface transaction-rate spikes and shared explicit device/IP identifiers linking multiple accounts.
No transaction feed, exchange, PEP list, blockchain node, SAR process, or regulator-calibrated model is connected. Sanctions screening uses official lists only where they are loaded (see Readiness), and is a fuzzy screen for review. Imported patterns can be incomplete or benign; corroborate against original records and policy. View transaction field contract ↗
WORKSPACE SHORTCUTS
Focused workspaces
Open a task-specific OCDC view; current data remains in one local tenant.
SOCSecurity operationsAlerts · incidents · connected sourcesOpen workspace →OTOT & infrastructureAsset posture · read-only events · risk contextOpen workspace →CASEInvestigations & evidenceCases · provenance · evidence referencesOpen workspace →DATAData science & analyticsSource-backed analysis · reusable insight artifactsOpen workspace →
Identity & governanceCurrent: local administrator only; central directory, scoped workspace roles, and region enforcement are not configured. Production target: OIDC/SSO, group-based access, tenant/workspace isolation, regional policy, brand governance, compliance/evidence policy, and audited role changes.
Review production controls ↗Review deployment profiles ↗Alert mix by severity
Counts from the current OCDC workspace. Select a bar to review matching alerts.
Loading current alert counts…
Counts reflect persisted records; sample and live data are labeled separately.
Data sources
Source records and verified connector state
SECURITY SERVICE MAP
Protection & response
What each protection service needs, and what OCDC covers today
Priority alerts —
Review and triage activity requiring attention
SEVERITY × STATUS × DETECTION TIME
Alert field
Explore the current alert records in space and time. Select a marker for its source, affected entity, and evidence.
IN THIS VIEW—
CRITICAL—
TIME NOT PLACED—
EarlierDetection time →Latest
Loading current alert records…
Near · NewMid · InvestigatingFar · ResolvedCriticalHighMediumLow
EarliestShowing through latest · all markers remain listedLatest
| ALERT | SEVERITY | SOURCE | DETECTED | STATUS | |
|---|---|---|---|---|---|
Loading alert records… | |||||
Investigations & case management 0
Cross-sector case intake, triage, assignment, due dates, linked alerts, source evidence, and an audited workflow timeline.
Open case intake contract ↗Loading incident cases…
Service desk queue
Open cases that need someone next, the nearest target first. Each one opens in the same audited case workflow.
| CASE | PRIORITY | STAGE | ASSIGNED | TARGET |
|---|---|---|---|---|
Loading open cases… | ||||
OCDC DECISION INTELLIGENCE · P5 VECTOR DATA
Graph Decision Intelligence
Explore tenant-scoped alert, case, evidence, endpoint event, imported dataset, CDR, OT/IoT, physical-security, financial-record, and detonation relationships in OCDC’s own graph store.
RELATIONSHIP VIEW · 2D / 3D / 4D · LOCAL GRAPH STORE
The same tenant graph, three ways to read it
2D is the plan view. 3D adds a perspective projection as a depth cue only. 4D replays records by their recorded observedAt, cumulatively or as a moving time slice. The domain lens plots one domain at a time with its record groups as separate clusters. Nothing here is a model, a score or a prediction; nodes without a timestamp are shown as such.
Sign in to load the tenant graph.
Graph not loaded · counts Unknown.
Table of the nodes in view (screen-reader alternative)
Search by label or select an object type to inspect matching graph records.
Node size reflects direct-link centrality; line weight reflects repeated record links. Click a node to inspect evidence and provenance.
Loading local graph analytics…
ELASTIC · AGGREGATE VISUALIZATION PATHExplore aggregate analytics with Elastic
OCDC writes graph topology and type counts only after an explicit admin sync. This panel reads back aggregate documents from the configured Elasticsearch destination; node labels, edge endpoints and evidence stay local.
Checking Elasticsearch readiness in the Analytics workspace…Auto-read starts after a recent Elasticsearch verification.
Indexed graph snapshotsElasticsearch query · aggregate metrics only · latest 8 snapshots
Not queried · Elasticsearch destination must be configured and verifiedAfter Elasticsearch is recently verified, OCDC reads and charts tenant-filtered aggregate snapshots automatically. A sync still requires an explicit admin action.
Kibana Cloud opens a separate deployment. It will show these documents only if the OCDC Elasticsearch destination is configured to that same deployment; the local Docker cluster is not automatically visible there.
Loading relationship graph…
Graph intelligenceLocal, deterministic and provenance-linked analysis
Calculating graph topology…
QUERY ASSIST · READ ONLY
Local query templatesExplore with a question
OCDC converts common requests into a visible, bounded filter plan. Review results before saving. This is not an LLM or Cypher generator.
Enter a question to preview matching OCDC graph records.
Saved plans
No saved query plans.
ENTITY RESOLUTION REVIEW
Context-ranked · analyst reviewExplainable match candidates
OCDC ranks same-type non-person entities using label similarity and shared graph context. Record adjudications clear reviewed pairs from the queue; they do not train a model, merge records, or assert identity.
Loading candidate matches…
Structural embedding candidates · fixed feature hashing
Calculating local graph embeddings…
Possible missing links · common neighbors
Checking graph structure…
GRAPH-BASED ALERTS
Manual evaluationBuild and review a rule
Combine OCDC graph relationships with a supported local rule template. Saving does not schedule or dispatch alerts.
Run local graph rules to view source-linked findings.
AlertTyped identifierRelationshipEvidence / recordDirected funds flowOCDC-owned SQLite projection · native graph store · bounded and local
OSINT DATA INTELLIGENCE · TENANT-SCOPED
OSINT analytics dashboard
Explore source coverage, analyst review, and explicit case/entity relationships in a time-aware local graph.
Loading OSINT recordsOpen source register ↗
Total OSINT records0Current tenant · open source register
Public crawl records0Scheduled and manual checks · review required
Linked cases0Records with a case reference
Needs review0Unreviewed or follow-up
Source hosts0Distinct recorded URL hosts
RELATIONSHIP GRAPH · LOCAL SVG VIEW
OSINT relationship field
Explore source-backed nodes and their links. URL-derived hosts are marked separately from explicit case and entity references; the inspector keeps supporting records in view.
OCDC local OSINT graphUnknown nodes · unknown links
Node size reflects direct links in this graph slice; repeated edges reflect repeated records.Depth cues
OBSERVATION TIMELINEAll available recordsUsing source-observed timestamps where supplied.
EarlierLatest available
Observation Source host / cluster Case EntityNode radius = direct-link degree · edge width = supporting-record frequency · dashed gold = URL-derived hostLocal graph status loading…
INVESTIGATION PATHS · TENANT DATA
OSINT use cases
Choose a workflow to pivot into the records that support it. Counts reflect loaded OCDC tenant records; no social feed is implied.
Review source observations explicitly linked to an existing case.
Inspect allowlisted public-page observations and analyst review status.
Pivot across recorded URL hosts. Host links are URL-derived, not identity attribution.
Review operator-supplied, authority-gated provider exports with provenance retained.
Scope & interpretationCounts and graph are tenant-scoped. Graph edges represent explicit OCDC links; source-host links are derived from recorded public URLs. This dashboard does not verify source authenticity or claim truth.
P2 INTAKE · P5 GRAPH · P6 ANALYST REVIEW
OSINT & open-source intelligence
Collect permitted public pages, record source references, connect source hosts to the local graph, and preserve analyst review.
PUBLIC SOURCE CRAWLER · TEN-MINUTE TARGET
ROBOTS.TXT · SAME HOST · SCHEDULED MAX 5 / MANUAL MAX 10Public updates and advisories
Configured target interval: ten minutes. The schedule status below reflects the interval loaded by this server process. Source-linked summaries and change history enter the OSINT register for review and analysis. Social-platform pages are excluded; connect an official API or import an authorized provider export for social data. Crawling does not train or update model weights.
RENDER ENGINEChecking Docker renderer…The built-in bounded HTTPS crawler remains available as fallback.
Loading schedule…Scheduled refreshLocal service schedule · max 5 sources · stops when OCDC stops
Loading allowlisted sources…
robots.txt, rejects private/reserved network targets, redacts email/phone-like text, and retains bounded summaries and hashes. Social platforms are not crawled; public social references can be recorded manually, and API/export data must retain provider and permission provenance. Newly found or changed content is untrusted and needs analyst review.FEEDS · SECTOR SOURCE PACKS · OFFICIAL SOCIAL APIS · DISCOVERY
ONE REQUEST PER POLL · SAME 10-MINUTE SCHEDULEPublic feeds, sector packs and source discovery
RSS, Atom and JSON feeds and the documented public endpoints of Mastodon, Reddit, Bluesky, YouTube Data API and your own Telegram bot are polled with one bounded request per run on the crawler schedule. Social pages are never crawled. Items are capped summaries with contact details redacted; nothing counts as live until a poll succeeds, and every item needs analyst review. Credentials come only from OCDC_* environment variables named on the source.
Feed and social sourcesLoading…
Loading feed sources…
Curated sector packsLoading…
Loading sector packs…
Bounded source discoveryReads a few pages from hosts this tenant already trusts and lists outbound links that match your keywords; nothing is fetched from a discovered host until you adopt it.
No discovery candidates yet.
robots.txt is a crawler preference, not permission to access a site. Confirm that collection is permitted under the source's terms. Social-platform content must use official platform APIs or authorized exports.
SOURCE INTAKE
ANALYST ENTRYAdd an observation
Store a reference and a concise source-attributed note. This form does not fetch URLs, sign in to social platforms, or verify claims.
Format: a JSON array or an object with an
items array. Provider-export rows need an approved authority reference.TENANT-SCOPED QUEUE
Loading…Source records
Loading case-linked source records…
Collection boundary Analyst-supplied references, authority-reviewed provider metadata, and manually initiated or scheduled public HTML crawls from an explicit host/path allowlist only. Provider exports require an existing case and approved authority review. Crawls honor robots.txt, never log in or open social profiles, and exclude hidden services and off-host links. Review status does not authenticate a publisher or establish the truth of a claim.
OCDC LAW ENFORCEMENT · CASE-SCOPED EVIDENCE · PUBLIC-SOURCE REVIEW
Law enforcement intelligence & evidence
OCDC-owned case workflow for authorized evidence references, custody review, and permitted public-source intelligence. Workflow counts are tenant-scoped; capability status describes this local OCDC build.
Open case evidence & custody ↗Add authorized transcript or source text ↗Open OSINT intake & review ↗Open public-source catalog ↗Open governance controls ↗
OCDC WORKFLOW AND READINESS
What works here, and what still needs engineering
Availability refers to the OCDC workflow shown, not a live provider, verified evidence, or operational authorization.
Loading tenant-scoped capability status…
VENDOR AND OPEN-SOURCE REFERENCES
Integration register
These entries document requested products and tools. A reference does not mean OCDC has installed, licensed, connected, or validated them.
Loading integration register…
ONE PERSON · ONE CASE · SECOND PERSON'S APPROVAL
Person movement
Built only from this case's records. Not live, no phone location, no camera tracking, and nothing about who this person was with.
Select a case and a person.
Collection and decision boundary OCDC's current local slice supports case-scoped text/evidence references, custody workflow, and governed public-source review. It does not perform voice or face identification, biometric matching, ALPR/VMMR, phone or vehicle location, live or camera-based person tracking, username enumeration, private-account access, or automated guilt/risk decisions. Raw audio, video, and image files are not processed here. Person movement above reads one person's recorded places from one case's own records, after a second person approves.
OCDC GRAPH INTELLIGENCE
Decision intelligence & investigations
Unify approved records, surface relationship context, and let analysts review the evidence behind each finding.
Unify & enrich
Build connected context from alert, dataset, case, and OT references.
Detect
Review transparent, source-linked patterns and graph relationships.
Analyze & decide
Open a relationship, inspect provenance, and carry the work into a case.
Unify & enrich
Detect
Analyze & decide
Solution workspaces
Each tile opens an OCDC workflow map and its current integration boundary.
These are OCDC workflow designs. OCDC provides local text and metadata intake, retrieval, and graph review; external evidence-processing engines require a separately configured provider.
2021 / 2023 solution portfolioEight documented solution lines · current OCDC implementation and gapsOpen portfolio map
InvestigationsLocal workflowCases, notes, tasks, evidence references, graph context and review.Open investigations →
eDiscoveryPartialCase-scoped text and metadata search; no legal hold or production review suite.Open evidence search →
Compliance & GovernancePartialControl mapping and evidence references; no certification or complete GRC service.Open assurance →
Endpoint ManagementMetadata onlyAuthorized event review; no endpoint agent, live host control, or verified isolation.Open endpoint review →
Data DiscoveryBounded local intakeSupported tabular and JSON formats, profiling, indexing, provenance and retrieval.Open data sources →
BI & ReportingLocal analyticsTenant-scoped summaries and exports; no scheduled enterprise BI service.Open analytics →
Text MiningText retrievalIndexed text and selected metadata features; no complete multilingual NLP suite.Open text search →
OEM Partner SolutionsIntegration scaffoldingConnector contracts and catalogs; provider connection requires authorized setup and verification.Open integrations →
Portfolio provenance: 2021 PDF pages 10–11 and 2023-named PDF pages 7–8. The 2023-named document is a shorter 13-page derivative with 2021 copyright metadata; see the forensic audit for the page-by-page crosswalk. Historical claims are not runtime evidence.
P2 · ASSET & ENTITY INTELLIGENCE
Asset & entity inventory
Explore entities derived from alerts, OCDC graph entities, and submitted OT / IoT asset observations in one workspace. The inventory with owner, class and scope is the asset register.
Loading inventory
Entity type distributionFrom the current OCDC graph projection
Open graph intelligence ↗Waiting for graph data…
Alert-linked entitiesLoading entity records…
Open OT asset posture ↗| Loading asset inventory… |
AI PROJECT FORECASTING · NATIVE · TENANT-LOCAL
Project forecasting — from your own delivery history
Transparent, empirical forecasting: OCDC learns how your completed projects' estimates ran over or under, then applies that distribution to planned work for P10/P50/P90 hours and cost, projected completion dates and an overrun-risk band. It shows the history size and the median ratio it used — no black box. Tenant-local; synthetic demo data is clearly marked.
Loading project forecasts…
IN-FLIGHT PROJECTS
Active & planned forecasts
Loading forecasts…
Forecasts are derived only from this tenant's own recorded project history; with no history the model assumes estimates hold (ratio 1.0). This is native OCDC capability — no external service is contacted.
THREAT INTELLIGENCE · EXPOSURE MONITORING FEEDS · TENANT-LOCAL
Exposure feeds — breach & credential exposure monitoring
Findings from exposure-monitoring providers (LeakData.io first): which monitored e-mail addresses and domains appear in which breach sources. Subjects are stored as a keyed digest and shown masked; OCDC never stores passwords, hashes, cookies or sessions. New findings raise a review alert.
Loading exposure feeds…
PROVIDERS
Feeds and delivery modes
IMPORT · ADMINISTRATORS
Import a monthly report
FINDINGS
Exposure findings
LATEST REPORT
Coverage and channel scores
SECURITY AWARENESS · NATIVE · TENANT-LOCAL
Security awareness & phishing-simulation tracking
Phishing-simulation and training outcomes turned into an explainable human-risk score. Each result is keyed by an opaque userRef — OCDC stores no names, addresses or message content. Tenant-local; synthetic demo data is clearly marked.
Loading awareness data…
PROGRAMMES
Simulations & training
Loading…
The human-risk score weights click and compromise rates up and reporting down; it is computed only from this tenant's own recorded outcomes. Native OCDC capability — no external service is contacted.
HEALTHCARE BILLING · NATIVE · TENANT-LOCAL
Healthcare billing & claims-abuse analytics
Screens medical claims for upcoding, unbundling, duplicate billing, phantom volume and modifier abuse, using only this tenant's own claim history to set peer baselines. Keyed by opaque provider and patient ids and procedure codes — no patient names, diagnoses or notes. Synthetic demo data is clearly marked.
Loading billing analytics…
ABUSE PATTERNS
Alerts by type
Loading…
HIGHEST RISK
Top-risk providers
Loading…
Billing-pattern analytics run on opaque provider/patient ids and procedure codes only; peer baselines come from this tenant's own history. Native OCDC capability — no external service is contacted.
VIDEO INTELLIGENCE · METADATA ONLY · NATIVE
Video intelligence
Forensic search, synopsis, occupancy and rules over metadata from your own cameras. OCDC stores no video, faces or plates and never tracks a person across cameras.
Loading…
BY CLASS
Objects by class
Loading…
FINDINGS
Rule findings to review
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
ALARM CENTER · DECISION MANAGEMENT · NATIVE
Alarm center
One queue across camera, access, intrusion, fire and OT alarms, with procedures. Triage ranks and explains; a person closes every alarm and no device is commanded.
Loading…
BY SEVERITY
Alarms by severity
Loading…
QUEUE
Triage queue
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
FUSION CENTRE · PLACES AND ONE MAP · NATIVE
Places register and fusion map
Sites, assets, zones, routes and areas with real shapes, and the tenant's alarms, device and drone events, sensor readings, video counts and assets placed on one map through them. Rules on a place raise leads for a person; hotspots count records per map cell and hour or day.
Loading…
Loading the map…
BY KIND
Places by kind
Loading…
Every view offers 2D (the flat map), 3D (a perspective projection: height shows a measure, never altitude; drag to rotate) and 4D (observation time: replay records, leads and hotspots). Offline: a graticule and a scale bar, no map tiles or outside service. No face recognition and no live capture. A hotspot is a place, never a person, and nothing predicts what anyone will do. A case's own points open only inside that case under an active judge's order, and person-related coordinates are never exported in bulk.
FUSION CENTRE · LOW-ALTITUDE AIRSPACE · ANALYSIS ONLY · NATIVE
Drone security: tracks, incursions and the response ladder
Detections from your lawful sensors and receivers (radar, radio detectors, cameras, acoustic sensors, Remote ID and network identification, cooperative aircraft) fused into tracks with altitude; drones, birds and aircraft told apart with their reasons; friend or foe against your own fleet, its missions, authorisations, restrictions and geo-zones; every incursion into a protected place scored with each factor explained; and the next lawful step of the response ladder for a person to decide.
OCDC never jams, spoofs, takes over or neutralises a drone, never transmits and sends no command to any device: it records requests, approvals and outcomes, and the authorised body acts through its own lawful systems. L3 and L4 need a senior person and a lawful basis. Pilot and take-off positions stay with the incident, carry no name and open only for the airspace investigator responsibility. No live feed leaves OCDC: a person sends a redacted copy that expires. The tracks are also layers of the fusion map, where "Height shows: altitude in metres" draws them at their height with a scale; each view offers 2D, 3D and 4D (replay in time order).
INVESTIGATIONS · DRONE FORENSICS · ANALYSIS ONLY · NATIVE
Drone forensics: seized-drone logs, memory cards and the court report
Each part of a seizure as its own exhibit; the files your forensic lab extracted read once, hashed and never stored; home, launch and landing, the flight's segments, its height against the ceiling, geofence and limit overrides, planned against flown path and the serial against what the airspace sensors saw; the log compared with an incursion track once the clock offset is estimated; and a court report that a second senior analyst signs off.
Do not power on a seized drone, controller or app device: image the storage and send the extracted files. OCDC decrypts nothing without a key you lawfully supply, calls no manufacturer's service and sends nothing to any aircraft. Every finding cites its file hash, record offsets and parser version. Take-off and home positions open per flight for the airspace investigator responsibility only, and who owns or flew a drone is linked only inside a case an active judge's order covers. Each view offers 2D, 3D and 4D (replay in time order).
PLATFORM · CAPABILITY TRUTH · NATIVE
Capability truth: what is proven
For every product and connector, six checked states with their evidence and when each was checked: code present, configured, signed in to its source, receiving fresh data, validated and deployed here. The connector kit beside it gives connectors secret references, signed webhooks with replay protection, retries with a dead-letter list and proofs of deletion.
Not checked is never green, and synthetic or demo data never counts as fresh real data. No secret value is kept, shown or logged: only Secret Manager reference names and whether each secret is present. Each list offers 2D, 3D and 4D views.
FUSION CENTRE · INCIDENT FORECASTING BY PLACE · NATIVE
Incident forecasting: hotspots, near repeats and patrol planning
Crime records, emergency-call logs and case diaries imported with every person field stripped and linked across sources; incident counts forecast per map cell or declared place and per day and hour of the week with their ranges; kernel-density hotspots, near-repeat alerts, backtests with their error, and patrol or inspection plans per place and shift for a person to approve.
Places and times only, never a person: no offender, victim or individual risk and no group of people. A forecast is decision support with its range and its past error, never a certainty; a senior person approves every plan and OCDC dispatches nothing. The forecast is also a layer of the fusion map, whose 4D replay runs from the recorded days into the forecast. Each view offers 2D, 3D (a perspective projection) and 4D (replay in time order).
PHYSICAL, CITY & GEO · SATELLITE IMAGERY · NATIVE
Satellite imagery analytics
Scenes from open programmes, licensed deliveries or your own uploads, kept with their source, licence and hashes; vegetation, water, moisture, burn and built-up indices for each place of the fusion map over time; clearings, burn scars, new water, bare ground and growth into a corridor since each place's baseline, each with an evidence page; the places and assets inside a flood, fire or earthquake footprint per industry; and claim checks against footprints and imagery.
Places and land only: imagery is never used to recognise a face or follow a person. A detection is a lead for a person and a claim check decides nothing; tying a detection to a case needs an active judge's order. The public catalogue pull stays off until an administrator turns it on. Each view offers 2D, 3D (a perspective projection; an index surface draws the index as height, not elevation) and 4D (replay in the order the scenes were taken).
PHYSICAL, CITY & GEO · GEOLOCATION AND IP INTELLIGENCE · NATIVE
Geolocation and IP intelligence
OCDC's own offline IP registry from the regional registries' public files, routing data, providers' published ranges and operator geofeeds, each with its date and licence; the network type of every address with a confidence and the reasons; one location-discrepancy engine for sign-ins, devices, service accounts and the fleet; where your and your suppliers' systems are hosted against your residency rules; and location-compliance answers for your own users.
Your own users, systems, assets and suppliers only: person-level location of anyone else needs a judge's order. Sign-ins show on the map as counts per cell, never as a person, and nothing is blocked here; every answer is advice to a person or to your own application. Fetching registry files stays off until an administrator turns it on. Each view offers 2D, 3D (a perspective projection; height shows a measure, never altitude) and 4D (replay in the order things happened).
TRANSACTION AND FOOTAGE REVIEW · NATIVE
Transaction and footage review
POS and ATM exceptions with a pointer to the footage to check. These are review items for a person, never findings about anyone. OCDC holds no media.
Loading…
BY RULE
Review items by rule
Loading…
REVIEW ITEMS
Top review items
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
INVESTIGATIONS · FORENSIC MEDIA LAB · NATIVE
Forensic media lab: authenticity, recovery and court reports
Lock an image's, a video's or a device dump's original, then check derived copies: file structure and metadata, compression history, error level and noise maps, perceptual hashes and content credentials. Split recorder exports by camera, carve files from raw dumps, blur marked regions, and take a disputed item from triage through an examiner's review and the context questions to a signed report.
The original is never altered, and every step is logged so it can be re-run. A sign is a lead, never a verdict: manipulated or synthetic needs two independent methods from different pillars. No face is recognised and no plate is read; faces and plates are only found to blur them. Each view offers 2D, 3D (a perspective projection) and 4D (replay in the order things happened).
MEDIA EVIDENCE · HASHES ONLY · NATIVE
Video and audio evidence
A register by SHA-256 with custody, two-person viewing, redaction work orders and transcripts. Media stays in your system; OCDC does no synthesis or speaker identification.
Loading…
BY KIND
Items by kind
Loading…
INTEGRITY
Items by integrity status
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
DETECTOR EVALUATION · NATIVE
Detector evaluation
Precision, recall and AP for object detectors you run, from their output files. OCDC ships no vision model and refuses person-identifying models.
Loading…
BY STATUS
Models by promotion status
Loading…
LATEST RUNS
Latest evaluation runs
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
DATA SECURITY POSTURE · NATIVE
Data security posture
Exposure, residency, stale data and over-permissioned access over a submitted inventory. OCDC changes nothing; regulation mappings are aids, not verdicts.
Loading…
BY SEVERITY
Findings by severity
Loading…
TOP STORES
Highest-risk stores
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
DATA-LOSS DETECTION · AUDIT MODE · NATIVE
Data-loss detection
Audit-mode verdicts by channel with exact match and fingerprints. Verdicts are advice: the caller enforces, and OCDC blocks nothing.
Loading…
BY CHANNEL
Alerts by channel
Loading…
RECOMMENDATION
Alerts by recommendation
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
LOST DEVICES · RECORDS ONLY
Lost and stolen devices
Report a lost or stolen device, whether or not it is in the inventory. OCDC records the report and never commands a device. A device it does not hold waits for a person to match it, and counts as an inventory gap.
SECURITY VALUE · YOUR OWN ROWS · YOUR OWN COSTS
Security value
What your security work measurably did, as counts and ratios of your own rows. Money appears only from costs a tenant administrator entered, with the arithmetic shown.
Loading…
TIME
Time to validate, respond and resolve
Loading…
RATIOS
Validated, false, corroborated, automated and within target
Loading…
YOUR TOOLS
What each connected source gave you
Loading…
MONEY · FROM YOUR INPUTS ONLY
The arithmetic, with its inputs
Loading…
TENANT ADMINISTRATOR · AUDITED
Your own costs
Native OCDC capability — tenant-local, no external service is contacted.
ALERT TO VERDICT · A PERSON CONFIRMS
Alert verdicts
An alert from any connected source gives indicators. OCDC checks them against stored intel and telemetry across every source, keeps them for later, and a person confirms the verdict.
Loading…
STATE
Confirmed so far
Loading…
LIMITS
What this does and does not do
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
INTEGRITY AND DRIFT · GOLD BASELINE · FOUR EYES
Integrity and drift
File, registry, process and service state compared with a gold baseline a second person approved. Metadata only.
Loading…
STATE
Open by change
Loading…
LIMITS
What this does and does not do
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
INSTALLED SOFTWARE · CVE · ALLOW-LIST
Installed software
Inventory compared with the advisories you hold, with patch verification and a clear flag for what is not on your allow-list.
Loading…
STATE
Results
Loading…
LIMITS
What this does and does not do
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
STAFF AUDIT · OFF BY DEFAULT · LEGAL REVIEW · WORKS COUNCIL · FOUR EYES
Staff audit
Removable media, application execution and file access by a pseudonymous digest. It stays off until the tenant has recorded that its works council was informed, along with its legal review and a second person's approval.
Loading…
STATE
Current state
Loading…
LIMITS
What this does and does not do
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
LICENCE PLATE DIGESTS · OFF BY DEFAULT · FOUR EYES
Licence plate digests
Keyed digests only, for allow-lists and case work, after a second person approves. OCDC does no plate recognition, keeps no plate text and links nothing across sites or cameras.
Loading…
STATE
Current state
Loading…
LIMITS
What this does and does not do
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
SECOND-PERSON APPROVALS · FOUR EYES
Approvals waiting
Leak datasets, biometric watchlist enrolments, forum collections and collectors, social-link hop exceptions and licence plate requests, in one place.
Native OCDC capability — tenant-local, no external service is contacted. This screen decides requests. It adds no search or matching.
SOC ROLES · JOB FUNCTIONS · RACI
SOC roles and RACI
Who does what, who holds each role, where the gaps are, and which job function and module each activity maps to. A SOC role grants no access.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows.
GOVERNANCE · RACI · POLICY SIGN-OFF · JOINERS AND LEAVERS
Organisation RACI
Who answers for each security task across the board, the CISO, IT, the analysts, legal, HR and the business, what OCDC holds for it, and who decides in an emergency.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
PRIVACY · RECORDS OF PROCESSING · ORGANISATION-WIDE
Records of processing
Every processing activity across the organisation, from draft to active. The client's counsel decides the legal basis, and OCDC does not act as a data protection officer or a lawyer.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
PRIVACY · IMPACT ASSESSMENTS · NAMED SIGN-OFF
Impact assessments
Screening prompts, risk rows, measures, a residual level a person sets, necessity reasoning and a named person's sign-off. The client's counsel decides whether one is required.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
PRIVACY · SUPPLIERS · AGREEMENTS · TRANSFERS
Supplier programme
One supplier row with tier and owner, intake and offboarding, criteria a person scores, processing agreements, transfers and question sets. OCDC adds no risk score, and nothing goes out to a supplier.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
PRIVACY · RETENTION SCHEDULE · NOTHING ERASED AUTOMATICALLY
Retention schedule
One table of class, period, method and owner, with lists of what is due for a person. OCDC erases nothing.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
PRIVACY · DATA SUBJECT REQUESTS · CONSENT LEDGER
Data subject requests
Take in a request, record how identity was checked, give each system its task, extend or close it, and keep a ledger of consents. Deadlines are editable defaults that support a decision: your organisation and its counsel decide what applies.
Native OCDC capability, tenant-local. OCDC contacts nobody and deletes nothing: system owners carry out each task. Counts are real rows, and every change is audited.
PRIVACY · INCIDENTS · NOTIFICATION CLOCKS
Breach and incident handling
Open an incident, start the clocks for the rules you pick, record each notification made, and keep the messages, escalations, reviews and exercises on one record. Clocks support a decision: whether to report, and to whom, stays with your organisation and its counsel.
Native OCDC capability, tenant-local. OCDC sends nothing and contacts no authority. Counts are real rows, and every change is audited.
GOVERNANCE · SUPPLIERS · ONGOING MONITORING
Supplier monitoring
Link a supplier, bring in exposures and certificates, record breach notices and what suppliers tell you, and work the alerts. A score is its assigned points, with each one shown.
Native OCDC capability, tenant-local. OCDC calls no outside service here and contacts no supplier. Counts are real rows, and every change is audited.
GOVERNANCE · SUPPLIERS · REVIEW AND FOLLOW-UP
Supplier reviews
Record each supplier review with its findings, your conclusion and a date to look again, and see what is due. A compliance reminder can raise a task when one falls due.
Native OCDC capability, tenant-local. OCDC draws no conclusion and contacts no supplier. Counts are real rows, and every change is audited.
AI SECURITY · AGENTS · PERMISSION MAP
Agent permission map
Declare each agent and what it was given. See what it can reach through that, what it did not use, and what it used without being given it.
Native OCDC capability, tenant-local. It reads what you declare and record, and changes no agent. Counts are real rows, and every change is audited.
COMPLIANCE · AUDIT FINDINGS · CORRECTIVE ACTIONS
Audit findings and corrective actions
Work what an audit or a review found: root cause, actions with an owner, a check that they worked, then close or reopen. A person does each step.
Native OCDC capability, tenant-local. This is the organisation's own record, not an audit opinion. Counts are real rows, and every change is audited.
GOVERNANCE · ACCESS REVIEWS · OUTSIDE ACCOUNTS
Outside access reviews
See who outside the organisation holds access, filter by what is odd about it, and run reviews a named person decides, viewers included. OCDC changes no account.
Native OCDC capability, tenant-local. It reads the exports you import and calls no identity provider. Counts are real rows, and every change is audited.
GOVERNANCE · PEOPLE · ROLES AND RESPONSIBILITIES
People-only work
Things only a person can do, given to people through the map your administrator keeps. OCDC has no default and no job titles.
Native OCDC capability, tenant-local. OCDC gives nothing to anyone by itself. Counts are real rows, and every change is audited.
COMPLIANCE · RISK REGISTER · DEPTH
Risk depth
Treatment tasks and a named person who agrees the plan, risks grouped into registers with one view across them, and a heat map that counts rows. Every score is one a person set.
Native OCDC capability, tenant-local. OCDC never rescores a risk and does not say any risk is acceptable. Counts are real rows, and every change is audited.
PRIVACY · READ VIEW FOR THE CLIENT'S OFFICER
Data protection officer's view
Open requests, breach clocks, activities, assessments, suppliers and retention in one read view with a file to export. The client's officer uses it, and OCDC does not act as one.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · ISO 27001 · STATEMENT OF APPLICABILITY
ISO 27001 applicability and evidence
Which controls apply and why, who owns each, and the records OCDC holds that can support it. OCDC does not certify or judge conformity.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
GOVERNANCE · OUTSIDE ACCESS · LINKS
Links for outside people
Which surfaces this organisation has turned on, every link issued, and revoking them. OCDC sends nothing: a person passes on each link.
Native OCDC capability, tenant-local. Each surface is off until a tenant administrator turns it on. A token is shown once and stored only as a keyed hash.
GOVERNANCE · WHISTLEBLOWING · NAMED HANDLERS
Whistleblowing channel
A link that takes reports with no login, with a thread on a one-time access key. Only the handlers named on a report can read it, and an administrator is not one by being an administrator.
Native OCDC capability. A report holds no address, browser details or cookie, and no time finer than the day. A person handles each report. It is never read by the Brain, a bot, a learning job or analytics. Deadlines are your own, and OCDC states no law.
GOVERNANCE · SUPPLIERS · ONE-TIME RESPONSE LINK
Supplier response page
Your question sets, a one-time link for one supplier, and the answers waiting for a person to review them.
Native OCDC capability. OCDC sends nothing and concludes nothing: you pass on the link, and a person reviews what comes back.
COMPLIANCE · AUDIT · RELEASED ROWS ONLY
Outside auditor access
A read-only link for one audit, showing only rows a person released, with a log of what was viewed and the questions the auditor posted.
Native OCDC capability. OCDC holds the record, and the auditor gives the opinion. The only thing an auditor can write is a question, which waits for a person.
COMPLIANCE · TRUST PORTAL · WRITTEN BY YOU
Trust portal
A page your organisation publishes: items public, restricted or hidden, your own terms, a sub-processor list you keep, and requests a person decides.
Native OCDC capability. Everything on the page is what a person here wrote. OCDC adds no claim of certification and no assurance statement. Counts are of real rows.
COMPLIANCE · POLICIES · VERSIONS · APPROVAL · RENEWAL
Policy centre
The text of each policy, its versions, who approved which, and when it is next renewed. A second person approves, and staff sign the version approved. OCDC does not judge what a policy says.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · RULES · REMINDERS · RUN LOG
Compliance events and reminders
Rules that raise a task or a note when evidence, a review, a policy, an SLA, a supplier assessment or an agreement is due, a control test fails, a risk changes or a task runs late. A rule approves nothing, changes no record's status and sends no email.
Native OCDC capability, tenant-local. No external service is contacted unless your tenant subscribed a webhook to these reminders. Counts are real rows.
COMPLIANCE · TRACKERS YOU DEFINE
Your own compliance trackers
A checklist for an internal requirement or a framework OCDC has no list for, in your own short labels. It records what evidence you linked. OCDC does not certify or judge conformity.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · CONTROLS · SHARED EVIDENCE
Control library
Your own controls, each with an owner and a status a person sets, mapped once to many tracker topics and ISO 27001 controls. Evidence linked once counts wherever the control is mapped. OCDC does not certify or judge conformity.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · CONTROLS · DAILY CHECKS
Control tests
The checks OCDC already runs over your imports, named one by one, with a dated result and a history. Old or absent data reads as not evaluated. A failing test shows on its control and changes no status.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · AI · DECISION SUPPORT
AI governance
Decision support over what OCDC holds about AI systems. OCDC lays the records out and a person decides. It states no legal result, classifies no system under any law and does not certify or judge conformity.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · WHAT WAITS ON YOU
My tasks
One list of what waits on you: tasks raised for you, policies to sign, training, access reviews, corrective actions and risks you own. Only yours: nobody else can open this page, and it shows no one else's work.
Native OCDC capability, tenant-local. No external service is contacted, and no email is sent. Counts are real rows.
COMPLIANCE · CONTROLS · READINESS · LINKS
Control readiness
Counts of what is open on each control, the same gaps ranked in one list, and the risks and policies a person linked. These are counts of rows and not a verdict: OCDC does not say a control works, and it does not certify or judge conformity.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · RISK REGISTER · TREATMENT · HISTORY
Risk register
Risks a person records and keeps up to date: owner, review date, treatment, a residual score the person sets, the history of each change, dated snapshots, CSV import and a starter library. OCDC never rescores a risk.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · EVIDENCE LIBRARY · RENEWAL
Evidence library
One row for each piece of evidence, with its owner, source and dates, linked once and used from a tracker topic, an ISO control or a risk. OCDC records and dates evidence and does not judge it.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · EVIDENCE FILES · SHA-256 · OFF BY DEFAULT
Evidence files
Files behind an evidence row, with a hash and versions, kept outside the state file. Off until the security decision is made.
Saved when you download them. OCDC never opens, previews or runs a stored file.
COMPLIANCE · EVIDENCE PULLS · READ-ONLY · OFF BY DEFAULT
Evidence pulls from outside systems
Read-only pulls from a cloud or SaaS system your organisation chooses to connect, into the checks OCDC already runs over imports. A tenant administrator turns this on and sets it up.
While this is off, OCDC calls no cloud or SaaS API. Credentials stay in the secret store, by name. Run only against local stand-ins so far, never a real provider's service.
COMPLIANCE · SUPPLIERS · IDENTITY EXPORTS
Suppliers an identity export suggests
Names found in an identity export that match no supplier row, for a person to decide on.
Reads what OCDC holds and calls nothing. Proposing starts an ordinary intake, and a senior analyst decides it.
GOVERNANCE · ACCOUNTS · PEOPLE
Accounts and people for access reviews
Import accounts and people from a file, or keep them current with a read-only pull.
Reading only: OCDC changes nothing in the system these came from.
GOVERNANCE · ASSET REGISTER · AUDIT SCOPE
Asset register
One inventory with an owner, class, audit scope and criticality set by a person. It fills when a person pulls from the records OCDC already holds.
Native OCDC capability, tenant-local. A pull reads OCDC's own records and changes nothing in any other system. Counts are real rows, and every change is audited.
COMPLIANCE · AUDITS · REQUESTS · FROZEN PACKAGE
Audit workspace
An audit with its requests, the tests people recorded, its findings and a signed package. It is OCDC's record, not an audit opinion. Auditors outside the tenant have no access in this version.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · QUESTIONNAIRES · APPROVED ANSWERS
Questionnaire answers
Take in a questionnaire, draft each answer from approved answers and held records, and let a person review and approve it. A draft cites its source or says no support found. Only approved answers are exported, and OCDC sends nothing.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
COMPLIANCE · TRAINING · QUIZZES · COMPLETION PROOF
Training
Short modules with a quiz and a pass mark you set, proof with the version and date, assignments by role and reminders on this screen. Proof is not a certificate and does not show that anyone meets a rule.
Native OCDC capability, tenant-local. No mail is sent. Counts are real rows, and marks stay with each person.
LEGAL · COOKIES · BANNER · CONSENT RECORDS
Cookies and consent
Your site's cookies from a list or file you give it, banner wording you write, and consent records with their expiry dates. OCDC contacts no site. A banner does not make a site compliant.
Native OCDC capability, tenant-local. No request goes to any site, and nothing here takes a request without a login. Counts are real rows, and every change is audited.
COMPLIANCE · EXPORT · READ-ONLY
Compliance export
Chosen lists of what OCDC holds, as one signed file a warehouse can load, on a schedule or when asked.
Nothing is pushed anywhere and no record changes. A person downloads each file, and the download is on the record.
COMPLIANCE · COUNSEL · AUDITOR · EXPORT
Counsel and auditor pack
A read-only file of records you select. It is OCDC's record, not legal advice and not an audit opinion.
Native OCDC capability, tenant-local. Lists are read with your own rights, and no record changes. Each export is noted.
ACCESS · RESPONSIBILITIES · PERMISSIONS
Roles & responsibilities
Which permissions each level and responsibility gives, who holds what, and why. A tenant administrator gives and removes them on any user of this tenant.
Native OCDC capability, tenant-local. No external service is contacted. Counts are real rows, and every change is audited.
PROCESS ANALYTICS · PUBLIC SAMPLES · OFF BY DEFAULT
Public event logs
Samples of real public event logs with their licences, and labelled synthetic processes where no real log exists. A tenant administrator loads and removes them. Each sample describes its named source, and not this client or its industry.
Reads files bundled with OCDC and calls no outside service. Counts are real rows. Loaded samples stay out of real figures by default and are never this client's evidence.
BRAND PROTECTION · TAKEDOWNS
Takedowns
Each takedown, its state, and who wrote and approved it. A draft waits for approval from someone independent of its author.
Native OCDC capability, tenant-local. OCDC sends nothing to a marketplace, registrar or host.
STAFF MONITORING · INFORM BEFORE IMPLEMENTING
Works council process
Records that the works council was informed before staff monitoring, as the tenant's stated process. The tenant's counsel confirms the legal position.
Native OCDC capability, tenant-local. This screen shows proposals only, never a person's activity, alerts or case content.
INSIDER-RISK REVIEW · OFF BY DEFAULT · NATIVE
Insider-risk review
Needs a recorded legal basis, DPIA, the tenant's stated works council process and a legal review record, approved by a second person. OCDC records the reference and is not legal advice. Pseudonymous, no person score and no automated consequences (GDPR Art. 22).
Loading…
STATE
Current state
Loading…
INDICATORS
Items by indicator
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
PASSIVE DEVICE DISCOVERY · IoMT / OT · NATIVE
Passive device discovery
Finds devices that cannot run agents, such as MRI scanners and infusion pumps, from flow metadata you already hold. OCDC sends nothing to any device and refuses patient data.
Loading…
BY CLASS
Devices by class
Loading…
BY FAMILY
Devices by family
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
CLINICAL MICRO-SEGMENTATION · RECOMMEND MODE · NATIVE
Clinical micro-segmentation
Zones and conduits from observed flows, with impact simulation and clinical sign-off. Export rules to your own firewall: OCDC enforces nothing.
Loading…
BY MODE
Policies by mode
Loading…
BY STATUS
Policies by status
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
RANSOMWARE CONTAINMENT · PRE-AUTHORISED · OFF BY DEFAULT
Ransomware containment
Fast containment for IT endpoints and identities under a policy two people approved in advance. Clinical, OT and unknown devices are never actioned; they escalate to a person. Going live also needs a per-tenant record of a clinical risk sign-off and a clinical safety owner, approved by a second person.
Loading…
POLICIES
Policies by state
Loading…
ACTIONS
Actions by status
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
HEALTHCARE EVIDENCE TRACKERS · NATIVE
Healthcare evidence trackers
Evidence tracking for BSI TR-03161, the hospital B3S, NIS2 and the HIPAA Security Rule. A tracker for your own review, never a compliance verdict.
Loading…
STANDARDS
Standards
Loading…
BOUNDARY
Scope
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
ADMINISTRATION · PILOT PROFILE
Sidebar for this organisation
Choose what this organisation sees in the sidebar, so a pilot shows what the client took on.
This keeps the screen tidy and is not access control.
STORYLINES · ALERT STITCHING · NATIVE
Storylines
Related alerts from logs, identity, network, cloud, data and AI, joined into one account of what happened, with the reason for each join.
Worked out from real rows you may read. It closes, merges and scores no one.
RECORD SEARCH · LOOK-BACK · NATIVE · OFF UNTIL A FOLDER IS NAMED
Record search
Search what was kept for as long as your retention says, and look back through it when a new indicator arrives.
Counts are real records. Every search is on record. It keeps no packets and decrypts nothing.
RETRIEVAL GUARD · AI DATA SECURITY · NATIVE
Retrieval guard
Read a document before it goes into an assistant's index: how sensitive it is, and whether it carries text written to steer the assistant.
Counts are real rows. It keeps a hash and the classes, never the text, and a person decides what is held.
LAW ENFORCEMENT · COURT-ORDER GATE · OFF WITHOUT AN ACTIVE ORDER
Court orders
Every feature that looks at a named person is off. It unlocks for one case only while a judge's signed order names the case, its subjects and the features allowed.
These features are off without an active court order. OCDC keeps the order's hash, never the document, keeps each subject only as a keyed hash with a masked form, and logs every use for the court.
ON CHIP MODULE · OUT-OF-BAND MEMORY EVIDENCE · OFF UNTIL TURNED ON
On Chip Module
Signed memory observations from inspectors outside each host: chain checks, point-in-time state, cross-host content search and detections sorted by lane.
OCDC reads no memory and acts on no host. It keeps envelopes and hashes; the bytes stay with the inspector and the client's storage.
PRIVACY · DATA SUBJECT REQUESTS · NATIVE
Data subject requests
From a public form or a request you record: a one-time code to confirm the person, a lookup of your own inventories for this request only, owner tasks inside the legal deadline, and a response pack with other people's data removed.
OCDC changes, deletes and sends nothing itself. It keeps no profile of anyone: what it finds belongs to the request and is minimised when the retention period ends.
COMPLIANCE & PRIVACY · FRAMEWORKS WORLDWIDE · NATIVE
Compliance frameworks worldwide
KRITIS and NIS2 under the BSIG, the KRITIS umbrella act and BSI IT-Grundschutz modules, the EU, US, UK, Asia-Pacific, Middle East and Türkiye frameworks, and IEC 62443 to requirement level, each line read against the evidence OCDC already holds, with the gaps, the reporting deadlines and coverage over time.
Decision support: control text is OCDC's own paraphrase, never the standard's text, and the crosswalk is OCDC's suggestion. A senior person confirms every line and nothing is attested or sent to a regulator. Each view offers 2D, 3D (a perspective projection) and 4D (replay of coverage day by day).
PRIVACY · BREACH IMPACT · NATIVE
Breach impact
Affected records by kind of data, by the people concerned and by where they live; who must be told and by when, with the 72-hour clock; and plain-language drafts of both notices.
Decision support, not legal advice. A senior analyst approves each notice and a person sends it: OCDC sends nothing.
VALIDATION · SAFE ATTACK SIMULATION · NATIVE
Attack simulation
Harmless test artefacts for your own e-mail, web, endpoint, DLP, WAF, DNS, SIEM and lateral-movement defences, and which ones blocked, detected or missed them.
OCDC sends no attack and touches no system. A person runs the plan on your own systems; OCDC reads what your defences reported.
DATA GOVERNANCE · ACCESS GOVERNANCE · NATIVE
Data access governance
Effective access down to the table and the column from your own entitlement exports, with unused access, sensitive data outside its owning team, broad grants, external principals and AI agents that can write sensitive data, least-privilege proposals and owner reviews.
OCDC reads the exports and logs you give it. It connects to no system of yours and changes nothing: a revocation is a line on a list for your administrators.
AI GOVERNANCE · AI SYSTEM REGISTER · NATIVE
AI system register
Each AI system in use with its owner, purpose, model, vendor, data sources and affected people, a guided EU AI Act tier with reasons, NIST AI RMF coverage, a model card, obligations with evidence and assessments.
The tier is OCDC's suggestion from your answers, confirmed by a senior analyst. It is a mapping aid, not a legal opinion, and OCDC switches nothing on or off in any AI system.
EXPOSURE · SECURITY RATING · NATIVE
Security rating
OCDC's own outside-in rating of your organisation and your suppliers: email security, web and TLS hygiene, exposure and compromise signals, each graded A to F with its reasons, and the trend over time.
Passive only: public DNS answers and one ordinary homepage visit. OCDC scans no ports and probes no service. A rating is a signal for a person to read.
INVESTIGATIONS · SUBJECT SEARCH · OFF UNLESS A COURT ORDER COVERS IT
Subject search
One identifier of a case's subject, searched across what this tenant holds and followed for up to three hops, as a graph of masked identifiers and the records that hold them.
An identifier the order does not cover is shown only as a linked identifier and is not followed. Identifiers are kept as keyed hashes. A leaked password is never shown. A person decides what a link means.
INVESTIGATION · CASE SUBJECTS · COURT ORDER REQUIRED
Subject social media
For the named subjects of a case under an active judge's order: where a user name has a public profile, the profile captured into the case with custody, how it changes over time, and the subject's visible circle.
Off unless the deployment turns it on and an order covers the case, the feature and the subject. Public pages only, anonymously; OCDC signs in nowhere, keeps no image and no face template, and never looks up people outside the order.
INVESTIGATION · ONE AUTHORISED CASE · COURT ORDER REQUIRED
Subject social media dashboard
One board for a case with an active judge's order: the court order, accounts found per site with their evidence, profile versions and what changed, custody, the social links graph, posting times, places, re-checks, the use of the powers and a case timeline. Below it, a 360° view of one order subject with links and communications in 2D, 3D and 4D.
Every card asks the court-order gate again on the server. Without an active order for the case and the feature, the board shows only which order is needed, with no data, no count and no name. People outside the order stay masked and never expand; revealing communication identifiers is audited, and maps past three hops need a second person's exception. No image, no face data, no message content, no sentiment about a person and no political, religious or health profiling.
INVESTIGATIONS · SUBJECTS UNDER A JUDGE'S ORDER · OFF UNTIL TURNED ON
Saved content and graphs for subjects under monitoring
Where a case subject's identifiers, names and leaked material turn up in what OCDC collected, with review and enrichment; forum and dark-web accounts linked to a handle; and ranked authorship leads.
Only while subject investigation is turned on and an active judge's order covers the case. Identifiers are kept as keyed digests with a masked form. Every result is an investigative lead, not an identification, and monitoring stops when the order ends.
INVESTIGATIONS · CASE GEO ANALYSIS · COURT ORDER REQUIRED
Case geo analysis
Search a case's location records by place, address, area, kind of record and time, and check whether named subjects of the order were in the same place at the same time.
Off unless subject investigation is on for this deployment and an active judge's order covers the case and each subject. OCDC never lists who else was in an area and never runs a tower dump.
INVESTIGATIONS · CASE ANALYTICS · NATIVE
Case analytics
Regression, clustering, set overlap, z-scores, association rules, a decision tree or correlation on a case table, chosen by the question you ask.
Fields that reach a person are replaced by a pseudonym first. Results describe the data; they are not decisions about people.
INVESTIGATIONS · CASE TEXT ANALYTICS · NATIVE
Case text analytics
Entities matched to your authority list, key phrases, categories, tone, similar documents, summaries and e-mail threads, in English and German.
Reads only what the case holds. Tone describes wording, never a person; people are shown masked.
POLICY · TOPIC SENTIMENT · AGGREGATES ONLY
Topic sentiment
How the tone of public items moves by topic and region: volume, sentiment, trend and themes.
No item list, no author and no group under five items: OCDC never shows or keeps one person's opinions.
INVESTIGATIONS · DATING APPS AND ROMANCE SCAMS
Romance scam investigations
The cases, centred on the person who was targeted, in 2D, 3D and 4D. Collecting about a suspect waits for a judge’s order.
FRAUD · SCAM EVIDENCE GRAPH · NATIVE
Scam evidence: reported and verified claims
Every claim about a scam address, domain, phone number, firm, case or campaign, with its source, licence, confidence, expiry, corrections and the owner's appeals, joined into a graph with every claim one click away.
Claims from consumer complaints stay reported and their losses unverified. An incident entry becomes an indicator only when an analyst promotes it with their own evidence. Tracker adapters are off until an administrator fills in their licence and switches them on. Phone numbers are kept only as keyed hashes. Each list offers 2D, 3D and 4D views.
FRAUD · CONSENTED TRUST SIGNALS · NATIVE
Consented trust signals
Only the signals a customer authorised, each for the purposes they authorised, with every point explained. A person decides what happens, and the customer can ask for a correction or appeal.
Findings, never automated decisions. Only an opaque customer token is accepted: no name, contact detail, network address or device fingerprint, and no person is looked up. People search stays behind a judge's order. Each list offers 2D, 3D and 4D views.
PRODUCT SECURITY · BILLS OF MATERIALS · NATIVE
Bills of materials: signatures, versions and release gates
Software, hardware and AI bills of materials with their signatures, components that keep one identity across releases, versions compared by each ecosystem's own rules, and findings in priority order with a reason for every point.
A version OCDC cannot compare reads needs review, never affected on a guess. Reachability comes from your own analysis. A release gate is a finding returned to your pipeline, which decides itself; a failed gate is waived only by a second senior person. Pipeline and lifecycle hooks are off until an administrator names their secret and turns them on. Each list offers 2D, 3D and 4D views.
PRODUCT SECURITY · THREAT ANALYSIS AND RISK ASSESSMENT · NATIVE
TARA evidence
Assets, damage scenarios, threat scenarios, attack paths, feasibility, risk and treatment for each product release, linked to its components and to compliance exports.
Risks use OCDC's declared, illustrative scale, which your assessors calibrate. A person decides every treatment, and a different senior person approves the analysis. Evidence for assessors, not a certification or a release approval. Each list offers 2D, 3D and 4D views.
PRODUCT SECURITY · DEVICE INTEGRITY AND CHANGE · NATIVE
Device integrity and change assurance
Verified device identity, signed policies, changes requested and approved by two people and staged from lab to fleet, rollback and recovery evidence, and records that stay trustworthy at sites without a connection.
OCDC records and checks. It installs no agent on any device and sends nothing to one: your own tools measure, update and roll back. The hand-off stubs are lab-tested and send nothing. Each list offers 2D, 3D and 4D views.
PRODUCT SECURITY · OPENSCENARIO · NATIVE
OpenSCENARIO import, coverage and regressions
Scenarios read from OpenSCENARIO files and from your own logs, linked to requirements, with results by release and the regressions a person reviews.
Synthetic scenarios stay labelled synthetic and are counted apart. What an import does not read is listed by name. OCDC runs no simulation here and does not judge whether a catalogue is complete. Each list offers 2D, 3D and 4D views.
AUTOMATION · OBJECT PERMISSIONS AND WRITE-BACK · NATIVE
Action fabric: object permissions and approved write-back
Who may read, act on or write back each object, a dry-run preview of every change, a second person's approval, and the outbox that delivers it to your own systems.
OCDC writes nothing into your systems by itself. Every call is signed with a secret you name, carries its own idempotency key and never follows a redirect. A delivered payload is deleted with a proof. Each list offers 2D, 3D and 4D views.
THREAT INTELLIGENCE · RESEARCH WITH CITATIONS · NATIVE
Research bridge: approved sources and verified citations
Sources an administrator approved, documents kept with their date, licence and hash, quotes checked against the stored text, and findings an analyst decides.
Findings are suggestions. The bridge reads only approved sources, follows robots.txt, and never changes code or deploys anything by itself. Each list offers 2D, 3D and 4D views.
SOC OPERATIONS · MANAGED SECURITY PROVIDERS · NATIVE
Partner console for managed security providers
Engagements, tenant separation, case hand-off between you and your provider, service levels against the agreed targets, and response actions you approve.
OCDC is the console; the staffed service is your provider's. Cases move by reference, a provider account cannot approve, and OCDC itself does nothing to a host or an account. Each list offers 2D, 3D and 4D views.
INVESTIGATIONS · OSINT PLACES · NATIVE
OSINT places and media verification
Place names in public records found in many languages and placed from OCDC's own offline gazetteer, and a workbench that records each step of checking where and when public media was made.
Only public records are read, and no private person is located. The workbench keeps OCDC's suggestion and your verdict in a hash chain; no face or plate is recognised. Each list offers 2D, 3D and 4D views.
PHYSICAL SECURITY · MARITIME · NATIVE
Maritime and traffic near sites
AIS decoded by OCDC itself, leads for dark periods, loitering near cables and routes, meetings at sea, port calls and identity changes, port activity against the usual level, and traffic near your sites.
Every rule writes a lead for a person. The traffic layer reads only approved feeds and is off until an administrator turns it on. Crew and owners are never looked up. Each list offers 2D, 3D and 4D views.
PHYSICAL SECURITY · TRACKED PLATFORMS · NATIVE
Tracked platforms: trackers, buoys, collars and containers
Operator exports and approved feeds with every fix checked, alerts for a buoy off station, a silent platform, a surfaced mooring or a sensor threshold, and the fusion map's geofences.
Assets, animals and objects only: person and driver fields are refused. Fixes are kept only for their retention, with a proof of deletion. Each list offers 2D, 3D and 4D views.
PHYSICAL SECURITY · MARINE ENVIRONMENT · NATIVE
Oil-slick leads and drift forecasts
Dark spots in radar scenes found and scored by OCDC for a person to confirm, and drift forecasts for spills, debris and lost objects from your current and wind fields.
Leads and forecasts are for a person; OCDC dispatches nothing. Each list offers 2D, 3D and 4D views.
THREATS · COORDINATED CAMPAIGNS · NATIVE
Coordinated campaigns in public posts
Near-duplicate text, synchronised timing, accounts active together and shared links joined into campaigns, each with its evidence for an analyst to judge.
About accounts and content, never a political profile of a person. Accounts are masked; an account's name is checked only for one case under a judge's order. Each list offers 2D, 3D and 4D views.
INVESTIGATIONS · OSINT SEARCH · NATIVE
OSINT search through approved providers
Queries through providers your administrators approved, each with its licence and terms, every query logged and every result kept with its provider, fetch time and address.
Off until an administrator turns it on. Only API answers are read: no result page is scraped and no sign-in page is read. A person query needs a judge's order. Each list offers 2D, 3D and 4D views.
EVIDENCE · WEB PAGE CAPTURE · NATIVE
Web page capture
A public page kept as it was served: redirect chain, addresses, certificate, hashes and a signed manifest, in the case's chain of custody.
OCDC follows no links, logs in nowhere, fills nothing in and never solves a human check. Page bytes are never shown as a page. A capture or a case's set exports as a standard WARC 1.1 web archive, and each export is a custody event.
EVIDENCE · CASE KEYWORD MONITORS · NATIVE
Case keyword monitors
A case's words and phrases watched in the text OCDC has already collected, with each match, its source and a short window of text.
A monitor watches words, never a person, and stops when it expires (at most 90 days). It fetches nothing and follows no one.
LAW ENFORCEMENT · CASE IDENTIFIER CHECK · NATIVE
Case identifier check
One username, e-mail address or phone number, checked for one open case under a recorded legal basis and a second person's approval or a judge's order, against the records this case already holds.
OCDC never searches any social network, site or breach collection for the identifier. It keeps only a keyed digest and a masked form, purges both when the retention runs out, and captures a public profile page only when the investigator names its address.
LAW ENFORCEMENT · CASE LINK CHART · NATIVE
Case link chart
One graph per case from what OCDC already holds for it, with alias candidates and their reasons, exported as GraphML, a plain XML link chart or JSON.
Only this case's records that your role may read. Identifiers are masked. Two nodes merge only when a person accepts the candidate.
LAW ENFORCEMENT · LEGAL RETURN IMPORT · NATIVE
Legal return import
Account records, message and call metadata, locations and installed apps a provider or a mobile extraction tool returned under an approved or served legal request, brought into the case with a hash, a custody event and a retention date.
Content only when the request covers it. Locations only of the case's named subjects; bulk location data is refused. Identifiers the request does not name are pseudonymised.
LAW ENFORCEMENT · CALL & INTERNET RECORDS · COURT ORDER REQUIRED
Call and internet record analytics
Call, message and internet session records a carrier or a satellite operator returned under a judge's order: imported with a preset for their layout, enriched from your own cell, handset and number-range tables, and analysed per case for the order's named subjects.
Returned records only: OCDC intercepts and captures nothing. Rows that touch no target of the order are withheld, tower dumps are refused, and every analysis, map and export needs an active order and is logged for the court. Each view offers 2D, 3D (a perspective projection) and 4D (replay in the order records were made). A mast position places a phone, not a person; the movement map stays on the case's own layer of the fusion map.
FRAUD & FINANCIAL CRIME · STATEMENTS, MULES, TRADE & TAX · NATIVE
Financial crime intelligence
Bank statements of a case followed hop by hop across its accounts, mule scores with device, network address and area, informal value transfer and trade-based laundering, the indirect-tax network of the case's firms with circles, missing traders and carousels, and adverse-media screening of organisations.
Leads for a person, never a decision: OCDC freezes, blocks, reports and contacts nothing. Account numbers are masked and kept as keyed hashes, each file is hashed as evidence, an area is a coarse cell or a country, and a named person is looked at only for a case subject under an active court order or a recorded KYC obligation. Each view offers 2D, 3D (a perspective projection) and 4D (replay of the money flow in the order it moved).
DATA & PLATFORM · LANGUAGES · NATIVE
Languages: identification, words and sentiment
The language of a text in 72 languages and 24 scripts with a confidence, sentence by sentence and for Russian and Ukrainian typed in Latin letters; words for Cyrillic, Arabic, Hebrew, Greek, Devanagari, Thai, Korean, Chinese and Japanese; normalisation, stop lists, and sentiment with negation in 13 languages.
OCDC's own profiles and lexicons, written for OCDC: nothing leaves the tenant and nothing is learned from your text. Sentiment describes wording, never a person. Each view offers 2D, 3D (a perspective projection) and 4D (replay in order).
INVESTIGATIONS · SPEECH TO TEXT · ON THIS SERVER
Speech to text
Recordings transcribed on this server in English, German, French, Spanish, Russian and Ukrainian, with timed segments, a confidence and the SHA-256 of audio and transcript, kept on the media-evidence item and read by the text layer.
Off until an administrator turns it on, and not installed until the local speech model is in place. No audio or text leaves the tenant, the audio is never kept, and who spoke is never identified. Each view offers 2D, 3D (a perspective projection) and 4D (replay in the order jobs ran).
DATA & PLATFORM · OBSERVABILITY · NATIVE
Observability: metrics, search, service health and availability
A native series store with rollups and retention per tier, one read-only search language over every record you may read, services with weighted KPIs and a health score, episodes that group related alerts, maintenance windows, change links, forecasts with the date a limit is reached, and availability checks on endpoints the tenant proved it owns.
Numbers and labels about systems only, never a person. Search reads with your rights and never writes. An alert is silenced only inside a window a second person approved, and availability checks ask only proved hosts, only while an administrator has them on. Each view offers 2D, 3D (a perspective projection) and 4D (replay in the order things happened).
NETWORKS, OT & IOT · CELLULAR & SATELLITE CONNECTIVITY · NATIVE
Cellular and satellite IoT connectivity
The tenant's own SIM and eSIM cards from the provider's exports: which are online, offline, blocked or inactive, usage and cost per device, group and plan, roaming, failover between cellular, satellite and fixed links, and cards that moved to another device, were copied, used the wrong access point or reached a place outside their group's allow-list.
Card numbers are masked and kept as keyed hashes, and a location is a country, an operator or a cell area, never a person. OCDC does not issue cards or act as an operator and acts on nothing by itself: a person proposes a response, a senior person approves it and the prepared request waits for the operator's own API behind a kill switch. Each view offers 2D, 3D (a perspective projection) and 4D (replay in the order events happened).
NETWORKS, OT & IOT · LARGE DEVICE FLEETS · NATIVE
Fleet device anomaly detection
Meters, controllers, sensors, chargers, terminals and vehicles, each against its own normal and against its peers. Anomalies with the same signs become one event type, a rule can be tried on past days before it is switched on, and edge models' training rounds are checked for poisoning.
Flow statistics only: no payload, no content and no personal data, and a fixed summary per device whatever it sends. OCDC acts on nothing by itself and never on a control loop or a device that bears on patient safety: a person proposes a response, a second person approves it and the prepared request goes to your own platform. Each view offers 2D, 3D (a perspective projection) and 4D (replay by day).
MONITORING · SATCOM SEGMENTS & TERMINALS · NATIVE
SATCOM segments, terminals and ground stations
Declared terminal ranges, closed groups and ground-station hosts; the terminal register from management exports with health, usage, firmware and logins; and detections over the flow exports OCDC already accepts, each with MITRE ATT&CK ids.
Analysis of imported records only: no capture, no tap, no payload inspection, no signal interception and no blocking. Locations stay a site or a grid cell and no record names a person. A detection is a lead for a person.
EXPOSURE · HARDWARE & FIRMWARE TRUST · NATIVE
Hardware & firmware trust
Attestation evidence compared with golden baselines, GPU and DPU posture against minimum versions and advisories, laptop fleet settings and wipe records, and AI agents connecting outside their sandbox.
OCDC cannot check a vendor's attestation signature itself: it records what the client's verifier said. It contacts no device and changes nothing.
INVESTIGATION · WATCHLISTS · NATIVE
Watchlists
Say when a watched domain, IP address, URL, crypto address or file hash appears in any new record.
Infrastructure and money only: names, e-mail addresses and phone numbers are never watched.
INVESTIGATION · PIVOT, PATHS & RISK · NATIVE
Pivot, paths and risk score
Everything connected to an entity, the shortest chain between two, what sits at the centre, and OCDC's own five-level risk score with its reasons.
Only records your role may read are searched. Nothing here profiles a person.
OSINT · PUBLIC EVENTS · NATIVE
Public events
Bursts in the public sources OCDC already collects, grouped into events with a brief and, where named, a country.
A burst is a signal to read, not a verdict. No private person is named.
CASES · HAND-OVER & WAR ROOM · NATIVE
Case hand-over and war room
Signed referral packages with STIX indicators, court-ready crypto traces, integrity checks, and one thread per case for notes and commands.
OCDC sends nothing anywhere: a person downloads a package and hands it over. Commands wait for a click.
EXPOSURE · DARK WEB MONITORING · NATIVE
Exposure monitoring
What your sources report has leaked about you: accounts, keys, documents, access for sale, ransomware listings, lookalike domains and protected executives.
Counts are real rows from your listed sources, including OCDC's own collector. It keeps no stolen password, cookie or key, and acts on no account.
FORENSIC REVIEW · DISCOVERY · NATIVE
Forensic review and discovery
Document review for an authorised matter: an early picture, grouping by meaning, concept search, learning from your coding, redactions and legal holds.
Counts are real rows. A person codes, redacts and produces. OCDC reads text it is given, and opens no binary file.
AI VISIBILITY · SHADOW AI GOVERNANCE · NATIVE
AI visibility
AI in use across your network, found as it communicates: which tools, how much, what is approved, and where sensitive data went.
Counts are real rows. OCDC reads metadata and decrypts nothing, blocks nothing, and keeps a keyed digest in place of a device or a person.
BAD-BOT DETECTION · NATIVE
Bad-bot detection
Automated attacks seen in OCDC's own traffic and in logs you import, with what to do proposed to a person.
Counts are real rows. OCDC blocks nothing here, and keeps a masked network rather than a whole address.
WORKFLOW LINKS · SLACK · TEAMS · JIRA · NATIVE
Workflow links
Short notices to your own channels and tickets in your own Jira, through OCDC's own connector. Off until an administrator sets them up. Nothing they send can change OCDC.
Calls only the services an administrator sets up here, and nothing by default. Counts are real rows. A person decides inside OCDC.
PROCESS DATA CONNECTIONS · NATIVE
Process data connections
Read-only pulls from a client's ERP, CRM and databases into the process analytics engine. Only mapped fields are kept, and each row is labelled with where it came from.
Loading…
SYSTEMS
What can be connected
Loading…
LIMITS
What it does not do
Loading…
Calls only the client systems an administrator configures, after a second person approves each host.
SOC PROGRAMME · NATIVE
SOC programme
Where the SOC keeps its business drivers, customers, governance, budget, privacy, knowledge, programme records, tools, services and charters, and the team's own record of its people and training. Each record shows its owner and review date.
Loading…
REGISTERS
Rows and reviews
Loading…
SOC-CMM
OCDC's gap counts
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
MAILBOX MONITOR · NATIVE
Mailbox monitor
Connect your own mailbox and OCDC reads the headers of new mail in your Inbox, and flags what looks like phishing for you to decide. Nothing else is read: not the message text, not attachments, not To or Cc, and not mail that was already there.
Connect Gmail Connect Outlook or Microsoft 365
You sign in at the provider and see what is asked for. The mailbox must be the one you sign in to OCDC with. Yahoo Mail and iCloud Mail are not available: they only offer an app password, and OCDC does not take those. After you sign in at the provider you come back here: press Finish connecting.
Native OCDC capability. Headers only. A flag is a suggestion for a person, and OCDC sends, changes and moves no mail.
SECURITY IMPORTS · NATIVE
Security imports
Bring in what your own tools export, then read what OCDC found in it: email, network, WAF, identity, cloud, SaaS, containers, attack paths, vulnerabilities, device configuration and firmware.
Native OCDC capability — tenant-local. OCDC reads the files you give it and contacts none of these systems.
FINANCIAL CRIME · NATIVE
Financial crime tools
Onboarding, claims, fraud rings, scams, merchants, the consortium, the fraud model, rule templates, risk signals and device sessions. OCDC recommends and records; a person decides.
Native OCDC capability. Results are recommendations: OCDC holds no keys, moves no funds and files no report.
FRAML · UNIFIED FRAUD + AML · NATIVE
FRAML — money-mule & unified financial crime
Fraud and AML scored from one data layer: money-mule cross-typology detection, explainable fraud+AML indicators, dual-track SAR/STR/SMR reporting and one deduplicated case per account. OCDC detects and records; it files no report.
Loading…
BY TYPOLOGY
Cases by typology
Loading…
REPORTING
Dual-track reports (SAR/STR/SMR)
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
FIAT↔CRYPTO DESK · AML · NATIVE
Fiat↔crypto conversion desk monitoring
AML and fraud screening for cash/fiat↔crypto conversion: CTR cash thresholds, structuring, fiat-in→crypto-out layering, source-of-funds, velocity and laundering language. Opaque references; nothing is converted or moved.
Loading…
ALERT TYPES
Alerts by type
Loading…
COUNTERPARTIES
Top-risk counterparties
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
SWIFT / ISO 20022 · NATIVE
SWIFT & correspondent-onboarding screening
Screens SWIFT/ISO-20022 messages and correspondent-onboarding sheets for fabricated big-figure transfers, beneficiary redirection, invalid BIC/IBAN, fake-funds narrative and shell/program markers. OCDC screens and records only.
Loading…
MESSAGES
Highest-risk messages
Loading…
ONBOARDING
Highest-risk onboarding (CIS)
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
CFT · FATF-ALIGNED · NATIVE
Counter-financing of terrorism monitoring
CFT typologies distinct from value-driven AML: small-value high-frequency, higher-risk corridors, consolidation to a single beneficiary, NPO/charity funnels, cash-intensive flows and sanctions nexus.
Loading…
TYPOLOGIES
Alerts by CFT typology
Loading…
ENTITIES
Top-risk entities
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
DOCUMENT FORENSICS · NATIVE
Deepfake & synthetic-document forensics
Structural/metadata/hash forensics plus fusion of external provider signals via the vectorization layer: editing-software, timestamp/field inconsistency, re-used images and splice edges. Explainable, not a generative-image classifier.
Loading…
REASONS
Alerts by type
Loading…
HIGHEST RISK
Top-risk documents
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
TREASURY · CONTROLS · NATIVE
Treasury: cash positioning & payment controls
Multi-account cash positioning, liquidity floors and payment controls (four-eyes, liquidity-floor guard, sanctioned-beneficiary block) with a forward projection. Governs and records; holds no funds and moves no money.
Loading…
CASH
Position by currency
Loading…
PAYMENTS
Payments by status
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
SERVER LINKS · IP-TO-IP · NATIVE
Server-to-server (IP-to-IP) link governance
An allowlist + policy layer over authorised server-to-server links: unauthorised peers, mTLS downgrade, geo and hours violations and volume exfil. OCDC captures no traffic and taps no sensor.
Loading…
ALERT TYPES
Alerts by type
Loading…
SOURCES
Top offending sources
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
PRIVILEGED ACCOUNTS · NATIVE
Privileged & shared account governance
A register and policy for service, admin, shared, default and break-glass accounts: interactive service logins, MFA bypass, off-network use, break-glass misuse, and posture (stale rotation, missing MFA, dormancy, shared-credential spread). No secrets stored.
Loading…
ALERT TYPES
Alerts by type
Loading…
RISKIEST
Riskiest accounts
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
BRAIN · CORE AI · NATIVE
Brain Core AI — vectorization & compute pillars
The Brain's native compute foundation with a live self-test: ML & NLP, SIMD/loops, linear algebra and image tracing. External provider data is vectorised into the platform instead of licensing that provider's stack.
Loading…
PILLARS
Compute pillar self-test
Loading…
PROVIDERS
Ingested providers
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
RPC ACCESS · BLOCKCHAIN · NATIVE
Blockchain RPC / node-API access monitor
Behavioural monitoring of blockchain RPC / node-provider API access (Infura/Alchemy/self-hosted): leaked keys used off-network, broadcast/signing on a read-only key, disallowed methods, rate spikes and key sharing. No key secrets stored.
Loading…
ALERT TYPES
Alerts by type
Loading…
RISKIEST KEYS
Riskiest keys
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
DATA ARCHITECTURE · DCDF · NATIVE
OCDC Decision-Centric Data Fabric
OCDC's own next-generation data analytics architecture: one tenant-local data layer that unifies ingestion & vectorization, storage, governance and 3D/4D analytics — realising and surpassing the warehouse, lakehouse, mesh and fabric archetypes, with every external provider vectorised in. See GET /api/data-architecture/model for the full model.
Loading…
LAYERS
Datasets by layer
Loading…
GOVERNANCE
In-layer governance posture
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
DATA QUALITY · MEDALLION · NATIVE
Data quality & lineage (bronze / silver / gold)
The medallion layer of the Decision-Centric Data Fabric: datasets scored on completeness, validity, uniqueness, timeliness and consistency, with promotion between layers gated on quality, and lineage tracing every gold dataset back to its bronze source. Tenant-local; OCDC measures and records, it transforms no client data.
Loading…
MEDALLION
Datasets by layer
Loading…
QUALITY
Datasets by quality grade
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
STREAMING · REAL-TIME · NATIVE
Real-time streaming analytics & alerting
The real-time plane of the Decision-Centric Data Fabric: named event streams with a bounded window, windowed aggregations (count / sum / avg / min / max) and threshold alert rules evaluated on every ingest, so a spike or breach fires immediately. In-process over the tenant's own data layer — no Kafka/Kinesis to licence.
Loading the live view…
Loading…
STREAMS
Events by stream
Loading…
ALERTS
Recent real-time alerts
Loading…
Native OCDC capability — tenant-local, no external service is contacted.
CRYPTO EXCHANGE SECURITY · NATIVE · TENANT-LOCAL
Crypto exchange protection & proof of solvency
Native defences for a crypto exchange: a withdrawal guard (address risk, amount anomaly, velocity, allowlist), the hot-wallet set-code/EIP-7702 authorization control (which stops a hot wallet being handed over to an attacker's contract), multisig signing-change detection, a retrospective threat-list lookback, and a Merkle-tree proof of reserves versus liabilities. OCDC screens and records; it never holds keys, signs, or moves funds. Synthetic demo data is clearly marked.
Loading exchange security…
PROOF OF RESERVES
Solvency by asset
Loading solvency…
WITHDRAWAL ALLOWLIST
Pre-approved destinations
Loading allowlist…
OPEN ALERTS
Exchange protection alerts
Loading alerts…
OCDC is the detection, governance and record layer — high-risk withdrawals and signing-config changes require a second person (four-eyes), and no funds move from here. This is native OCDC capability; no external exchange or analytics service is contacted.
MANAGEMENT DASHBOARD · KPI FIELD · ALWAYS 3D / 4D · LOCAL
Management KPI field — 3D constellation, 4D over time
The tenant's headline KPIs as an always-3D constellation: each KPI is a node sized by its current value and grouped by family. 4D replays the dated portion of each KPI over observation time. 3D is a perspective projection (a depth cue) and 4D is recorded observation time — not extra data dimensions. Every value is a tenant-scoped count of local records; selecting a node opens its workspace.
Sign in to load KPIs.
Loading KPIs…
PROCESS ANALYTICS · DISCOVERED FROM EVENT LOGS · TENANT-LOCAL
Process analytics
Every process with real timestamped history, side by side. Open one to see its map, and drill from a summary to the delays, handovers and deviations behind it, down to one case's exact events.
Built only from this tenant's own rows. Suggestions are for a person to weigh: OCDC proposes and triggers nothing. By role or team, never by a named person.
Synthetic demo data is present
Showing: Real rows only. Synthetic rows are left out.
Loading processes…
Native OCDC capability. No vendor product, and nothing here acts on a system.
COMPLIANCE EVIDENCE · A TRACKER, NEVER A VERDICT · TENANT-LOCAL
Compliance evidence dashboard
How much of each framework's topic list has evidence linked or a review recorded, by framework and by industry, with the rows behind every number.
This is an evidence tracker, never a compliance verdict. OCDC does not certify, assess or attest conformance with any standard or regulation. Only auditors or counsel can.
Synthetic demo data is present
Showing: Real evidence only. Synthetic rows are left out.
Loading coverage…
Loading evidence coverage…
SECURITY VALUE · LAST 30 DAYS · OPEN
What your own rows measure
Loading…
BY INDUSTRY
Average evidence coverage across the frameworks that apply
Loading industries…
BY FRAMEWORK
Evidence coverage, reviews and topic counts
Loading frameworks…
OTHER MEASURES
Open the KPI view in 2D, 3D and 4DOther percentages from this tenant's rows
Each keeps its own name and definition. They are different measures and are never merged into one score.
Loading measures…
KPI & SLA MANAGEMENT · NATIVE · TENANT-LOCAL
KPI & SLA management — strategic KPIs meet operational SLAs
Overall SLA compliance, ticket and task volume, active breaches and resolution time, measured against each priority's SLA target. Every resolved item is judged by one rule: if the actual hours are within the priority target it is Within SLA, otherwise SLA Violated. Live SLA clocks show the time left on active items, and every metric carries a traffic light: green meets target, amber is close to target, red is below target or breached. Metrics without data show Unknown, never 0.
Loading SLA metrics…
COMPLIANCE TREND
Daily SLA compliance vs target
Loading trend…
TRAFFIC LIGHT BY PRIORITY
Compliance and live clocks by priority
Loading priorities…
RESOLUTION SLA
Average resolution time by priority vs SLA target
Loading resolution times…
RESPONSE
First response and availability
Loading response metrics…
RESOLUTION
Quality and uptime
Loading resolution metrics…
EFFICIENCY
Backlog, queues and vendors
Loading efficiency metrics…
LIVE WARNINGS
SLA clocks on active items — most urgent first
Loading SLA clocks…
Targets are the OCDC default SLA policy, not a contractual commitment.
OCDC PRODUCT & BEHAVIOURAL ANALYTICS · NATIVE · TENANT-LOCAL
Product analytics: funnels, retention, cohorts & journeys
Product analytics over your tenant's own behavioural event stream, built natively in OCDC. Events, funnels, retention cohorts, behavioural cohorts, user journeys and a tracking plan — no external analytics SDK, and nothing leaves OCDC. Every number is of the events your tenant has sent; synthetic demo rows are clearly marked.
Loading product analytics…
CONVERSION
Funnel
Enter ordered steps and build the funnel.
RETENTION
Cohort retention
Build a cohort retention curve.
BEHAVIOURAL COHORT
Cohort builder
Define an event-based cohort.
USER JOURNEYS
Paths
Trace the common next steps after an event.
DATA GOVERNANCE · TRACKING PLAN
Tracking plan
Loading tracking plan…
Measurements are of the events your tenant has sent; anonymous visitors can be stitched to a known user so the pre-sign-up journey joins the eventual customer. This is native OCDC analytics — no external analytics service is contacted.
TI HUNTING
Search across alert evidence
Run a local similarity search over indexed OCDC events. Raw telemetry search requires a connected source.
REPORTS
Analyst exports
Build portable records from the current OCDC workspace.
REPORT DESIGNER
Sign in to use the Report DesignerBuild your own reports: templates, live preview, schedules
Compose a report from blocks: headings, text, KPI tiles, tables, charts and data sections. Every data block reads from an allowlisted, tenant-scoped data source; there is no free-form query. Generated reports are stored for download as HTML, PDF or JSON and carry the classification marking on every page. Analysts and tenant administrators edit and generate; only tenant administrators schedule or delete templates; viewers open generated reports.
Choose a template or create one from a starter.
Add block
Schedule and recipients
Live preview
The preview appears here.
Generated reports
| Report | Generated | Trigger | Marking | Delivery | Download |
|---|---|---|---|---|---|
| Sign in to see generated reports. | |||||
MALWARE ANALYSIS
Detonation intelligence
Search imported report metadata, verdicts, hashes, extracted indicators, behaviors, and ATT&CK techniques.
Report intake contract
Report intake route · see the API catalogueBearer token required. Submit report ID, filename, hashes, verdict, environment, duration, indicators, behavior, and techniques. Configure a supported provider API or export for this tenant before enabling report delivery.OCDC ONTOLOGY · SEMANTIC AND KINETIC LAYER
Object types, links, governed actions and versions
Every record in the tenant is an object of a declared or inferred type with marked properties. Links follow the records' own keys. Actions are the only governed write path for people, applications and agents; approval-flagged actions need a second administrator. Custom types, properties and links enter through approved change requests and are versioned.
Pick an object type.
ACTION REQUESTS
—Awaiting a second administrator
CHANGE REQUESTS · VERSIONS
—Custom types, properties, links
Propose a custom object type
ACTION LOG
Every applied action
OCDC AI DEFENSE · PREVENT · SECURE · MONITOR
AI systems, guard decisions, agent ledger and posture
Register every AI application, agent, model, MCP server, tool and dataset; attest artefacts and pin tool manifests; screen prompts, outputs, tool calls and memory writes through a deterministic guard that stores decisions but never text; keep a hash-chained ledger of what agents did; import red-team results; and read posture against OWASP LLM, OWASP Agentic, MITRE ATLAS, NIST AI RMF, ISO/IEC 42001, the EU AI Act and CSA AICM at once.
REGISTER
An AI system
ATTEST
A model artefact or MCP tool manifest
REGISTRY
AI systems
ATTESTATIONS
Artefacts and pinned manifests
GUARD TESTER
Screen text, a tool call or a memory write
The text is screened in memory on the server and discarded; only the decision (hash, length, categories, verdict) is kept. Integrations call POST /api/ai-defense/guard with the same fields.
RECENT DECISIONS
—Verdicts and categories
AGENT ACTION LEDGER
—Hash-chained, verifiable
RECORD
An agent action (integration example)
CONTROLS
Evidence per control
EVALUATIONS · RED-TEAM IMPORTS
promptfoo, garak, PyRIT, Giskard, AgentDojo or custom
TENANT POLICY
—What the guard enforces
DATA-CLASS EGRESS
What may leave through output or tool calls
PER AGENT · 24H BY DEFAULT
Tokens, tool calls, budget, model allow-list
OCDC THREAT KNOWLEDGE · FEEDS · IOCs · USE CASES · DEFENSE LEARNING
What the world is attacking, what to block, and what OCDC learned in the last five minutes
Curated AI-threat and crypto-scam IOC feeds, scam trackers (DFPI, FCA, CFTC) and attack timelines (Hackmageddon, DefiLlama, Web3 Is Going Just Great) become one tenant indicator store and a landscape that maps techniques to prevention playbooks. Every five minutes OCDC expires stale indicators, polls what you subscribed to, re-weights its guard from your analysts' decisions and raises proposals — a person accepts or dismisses them.
SEARCH
—Active indicators
MATCH
Check values against the store
TOP TECHNIQUES · INITIAL ACCESS · MOTIVATIONS
Last 60 days
PREVENTION PRIORITIES
Playbooks weighted to your sectors
PROPOSALS
Accept into a hardening task or dismiss
SELF-CHECK · GUARD TUNING · FEED RUNS
What the loop did
TENANT ADMINISTRATION
Accounts, settings, notifications and data
Tenant administrators manage who can sign in, how the tenant is named and configured, where notifications go, and the tenant's own data. Everything here is scoped to the current tenant and recorded in the audit trail.
ACCOUNTS
—Who can sign in
ROLES
What each role may see and do
Loading…
APPROVALS
Role changes waiting for a super admin
Loading…
TENANT SETTINGS
Name, locale, retention policy, demo data
Demo and synthetic rows in this tenant—
Which lists
To bring data back, choose Allow demo data first. Load synthetic scenarios then gives back only a small pack: 10 alerts and 34 rows in all. Restore full demo set loads the whole synthetic set without a restart. A restart of a server that seeds synthetic data also brings most of it back, but leaves the switch off.
Demo dataSINGLE SIGN-ON
—OpenID Connect identity provider
NOTIFICATIONS
—Webhooks
TENANT DATA
Export, erasure, about
Erase this tenant's records
Removes every record of the current tenant except the audit trail and the account directory. Refused while legal holds are active. Type the tenant id to confirm.
AUDIT
Recent changes, newest first
Loading…
SETTINGS & INTEGRATIONS
Connected platforms
Integration readiness, supported event paths, and setup requirements.
XDR inbound event contract
XDR intake route · see the API catalogueJSON event batches use the configured ingestion bearer. CEF-over-HTTP support is exposed for syslog relays. Configure the provider's destination, token and tenant scope before sending real events.OCDC OPM · ORCHESTRATED PATCH MANAGEMENT · DISCOVERY · CMDB · CAMPAIGNS · VERIFICATION
Orchestrated Patch Management
From "what is vulnerable" to "verified patched". OPM reconciles the assets OCDC sees with your CMDB, ranks missing patches by known exploitation, CVSS, exposure and criticality, and plans campaigns in rings and maintenance windows. Standard changes can be approved by your policy; all other changes need a second person. Released waves go to your own deployment tool (Intune, SCCM / WSUS, Ansible, Jamf), which installs them. A failure-rate gate halts later waves, and a later scan proves each fix.
Missing patches by priority
Discovery and CMDB validation
Campaigns
OCDC SERVICES · MANAGED CYBER DEFENCE · ASSESSMENTS · REPORTING · LICENSING
Service operations
Run the OCDC services from the platform: weekly and monthly managed-SOC reports, Compromise Assessments, NIST CSF 2.0 / IEC 62443 / incident-readiness assessments, awareness metrics from the customer's own training tools, import of the customer's own scanner results, TAXII 2.1 sharing, and licence usage with per-device quotes.
Managed-SOC reports
TAXII 2.1 sharing for SIEMs, firewalls and TIPs: (read-scope token).
Licence usage
LAW ENFORCEMENT · GOVERNMENT · LEGAL · CASE-SCOPED TOOLS
Investigation tools
Case-scoped tools for police, prosecutors, regulators and government CSIRTs: selector search with link charts, deconfliction across cases, case timelines, legal-process requests (preservation, production orders, MLAT), signed disclosure packages with four-eyes approval, email and calendar chronology, sensitive-data discovery, keyword watch and PDF reports. Each one needs a case you are cleared for and, where it touches personal data, a stated lawful basis. Every use is written to the signed audit trail. All searches run over records already in this tenant. Nothing is looked up outside, and no person is profiled or identified.
Case timeline
Text mining on case evidence
Key phrases, entities (emails, phones, IPs, crypto, money, dates), crime-category scoring, summaries, language and near-duplicates. No sentiment or authorship analysis of persons.
Sensitive-data discovery
Finds IBANs, card numbers (checksum-validated), emails, phone numbers, dates of birth, IP addresses and secrets in evidence, datasets, communications and alerts. Shows counts and locations only, and moves or deletes nothing.
Restricted cases
PDF reports
OCDC CONNECT · AI · CLI · IP · SYSLOG · SSH · ANY PROTOCOL
Connect any device, application and network
OCDC is one orchestration platform for the whole estate: servers and endpoints, network devices, cloud and SaaS, applications, identity, email, AI systems, OT / ICS, IoT and smart-city devices, cameras and access control, drones and comms links, vehicles, threat intelligence and forensic tools. Each method below is checked against this build; the edge collector brings in devices that cannot call an API (syslog over UDP / TCP, file tail, read-only SSH).
Coverage by asset class
Connection methods
NETWORK, ENDPOINT & INVESTIGATION CONNECTORS
Security integrations
Connector contracts for network detection, behavioral defense, endpoint evidence and investigation enrichment.
Normalized intake adaptersReceiver readiness and provider connectivity are separate states
Provider connection readinessMissing settings show environment-variable names only. Credentials are never returned here.
Loading provider connection readiness…
Microsoft Sentinel & PurviewSentinel export through the Azure Monitor Logs Ingestion API and read-only Sentinel incident import; read-only Purview DLP and Insider Risk alerts (Microsoft Graph) and Purview Data Map sensitive assets. Each direction has its own switch; client secrets stay in a server environment variable.
Loading| Direction | State | Last run | Next | Result |
|---|---|---|---|---|
| Loading… | ||||
Connection settings · tenant administrators
Recent runs
Purview sensitive data assets
Connector boundaryOCDC accepts normalized event metadata. Tenant API polling, account authorization, packet capture, autonomous response, social scraping, interception and device acquisition are not active in this demo. Provider credentials are never entered in the browser UI. Open normalized event contract ↗ · Adapter mapping and API design ↗
PLATFORM API · VERSION 1
OCDC API & solution catalog
Trace each service and portfolio solution to its tenant-local records, workspace, API route, and reference-only boundary.
OCDC portfolio · market gap reviewOfficial-source design benchmarks · source-tree implementation evidence · dated 19 Oct 2026
Loading source-linked market review…
Loading P1–P7 and L1–L7 gap map…
Adjacent high-risk capability: facial / biometric evidence
No biometric matching or person-identification capability is evidenced in this OCDC build. The current market map records this as deferred, not implemented. Any future work needs a narrowly defined lawful purpose, jurisdiction and consent/authority model, retention and template-protection design, human review, and independent evaluation of accuracy and demographic differentials before product scope is chosen.
NIST Face Recognition Technology Evaluation ↗Counts and route details load from the signed-in OCDC API.
This inventory reports locally registered routes and tenant-local records. Runtime health and provider connectivity are separate checks; portfolio references are not active integrations.
Loading OCDC API service groups…
2021 / 2023 PORTFOLIO CROSSWALK
LoadingSolutions mapped to OCDC routes
Loading solution map…
INDUSTRY WORKFLOW MAPS
LoadingIndustry data paths
Loading industry maps…
Local data paths open tenant-scoped OCDC workspaces and read APIs. Portfolio-only references are listed separately. A local route or local record is not evidence of a live vendor feed; check Data Sources and integrations for verified connections and last sync. API implementation indicates a local handler exists, not live provider connectivity, production availability, or certification. Read/write access remains identity- and scope-controlled.
P2 · EXTERNAL EXPOSURE WORKFLOW
Attack-surface findings
Import findings from an authorized scanner or reviewed export, track remediation evidence, and record reassessment outcomes.
Open findings0Imported observations
Data boundaryOCDC does not scan the internet or assets, validate third-party findings, continuously monitor a perimeter, or execute remediation. Imported Error / Warning / Passed outcomes are attributed to their source and remain separate from verified OCDC detections.
PASSIVE EXPOSURE INTELLIGENCE · OCDC NATIVE
Authorized asset enrichment
Query SecurityTrails or Shodan existing data for one explicitly authorized organization domain or public IP. Every query is manual, tenant-scoped, source-attributed and review-required.
Loading provider readiness…
Authorized scopesAdministrator-managed · expires automatically · can be revoked
No authorized assets recorded.
SpiderFoot reviewed exportImport at most 250 JSON events into a recorded scope; only matching domain/IP records are retained
Provider observationsMinimized metadata · raw provider responses and banners are discarded
No passive provider observations.
Tool references and OCDC boundaryOCDC implements its own scoped passive query and analyst-review path. Mitaka is a third-party browser extension; OCDC does not install it in this workspace and provides its own scoped provider pivots. SpiderFoot includes broad scan modules and third-party dependencies; OCDC does not install it or run scans. Its JSON export intake is limited to the selected authorization scope and excludes source-data text, URLs, personal identifiers, and out-of-scope events. No newly discovered host is fetched or scanned automatically.
OCDC use casesAgency-domain inventory review · external DNS drift review · public-service ownership reconciliation · passive indexed service review · scoped SpiderFoot export triage. Results are investigative leads, not verified vulnerabilities or ownership claims. Shodan DNS queries may consume plan credits; Shodan requires its API key in the HTTPS query string, so external network telemetry must not log query strings.
Open implementation and operating guide ↗| FINDING / SOURCE | ASSET / CATEGORY | OUTCOME | OBSERVED | STATE | CASE / ACTION |
|---|---|---|---|---|---|
| No external findings imported. | |||||
Normalized intake contract
POST /api/ingest/external-attack-surfaceBearer-protected. Submit source, externalId, asset, category, Error / Warning / Passed outcome, severity, timezone-qualified observedAt, title, sourceRef, and optional caseId, detail, recommendedAction, and threatContextRef. Results are P5-indexed and projected into the OCDC graph as imported metadata. Open JSON schema ↗ · Workflow and limits ↗P2 · MULTI-DOMAIN OBSERVATION INTELLIGENCE
Global sensor mesh
Search time-sensitive, authorized orbital, airborne, and terrestrial observation metadata across regions and topics.
Source and action boundarySearch runs over tenant-local imported records with source and authorization references. No live sensor providers, tasking, aircraft or satellite control, people tracking, external model orchestration, or real-time global coverage is connected.
Ask across local observationsDeterministic keyword, region, topic, domain, and time-window filters
Run a search to see domain, topic, and region counts.
Import an authorized observationAdministrator only · metadata only · no payload or precise coordinates
| OBSERVED | DOMAIN / SENSOR | TOPIC / METRIC | REGION | VALUE | SOURCE & STATUS |
|---|---|---|---|---|---|
| No matching observation records. | |||||
OCDC PRODUCT · DIGITAL TRUST & FRAUD DEFENSE
Identity, session & transaction risk
Bring authorized first-party and provider-reported risk categories into a tenant-scoped analyst queue. This complements the existing Fraud & AML review product with normalized digital-footprint, device, session, and commerce context.
OCDC TRUST ENGINE · NATIVE DIGITAL FOOTPRINT, DEVICE, BEHAVIOUR & AML SIGNALS
Native · readyEvaluate an event with OCDC's own risk engine
Explainable rules over derived, non-identifying features plus this tenant's own history (device sharing, velocity, structuring, rapid in-and-out). Recommendations are for analyst review; OCDC approves, declines or blocks nothing. Requires the tenant's lawful-purpose declaration and privacy notice.
OCDC TRUST ENGINE · CARD-NOT-PRESENT & ACCOUNT-TAKEOVER SCENARIOS
LoadingCard-not-present & account-takeover
Eighteen explainable scenarios over tokenised payment, login, account-change, MFA, 3-D Secure, session and chargeback events: card testing, BIN attacks, velocity, geography, high-risk MCCs, 3-D Secure bypass, new-account and reshipper patterns, prepaid rotation and chargeback feedback; credential stuffing, password spraying, impossible travel, takeover change chains, MFA fatigue, session hijack, SIM swap and dormant reactivation. Each recommends allow, step-up, review or block (hold for review); OCDC never declines, locks or reverses anything. Cards are token, BIN and last four only.
Events evaluated—This tenant
Flagged—Step-up, review or block
Open cases—Awaiting an analyst label
Synthetic detection—Lowest scenario rate
Synthetic false positives—Benign events not allowed
Scenario catalogue, thresholds and synthetic detection
| SCENARIO | RULES · THRESHOLDS | DETECTION | FALSE POS. | CASE PRECISION |
|---|---|---|---|---|
| Loading scenario catalogue… | ||||
Top reason codes
- No events evaluated yet.
Tuning suggestions
Labels drive suggestions; nothing changes automatically.
Cases
| CASE | SCENARIO · REASON CODES | RECOMMENDED | EVENTS | LABEL |
|---|---|---|---|---|
| No CNP or account-takeover cases. | ||||
Recently flagged events
| OBSERVED | EVENT | SCORE · ACTION | REASON CODES | CASE |
|---|---|---|---|---|
| Nothing flagged. | ||||
Synthetic measurement uses a seeded, labelled set (benign customers plus every attack pattern, some deliberately under threshold); it is not a substitute for back-testing on your own labelled data.
Privacy and decision boundarySubmit only tenant-generated opaque subject tokens, source references, and normalized categorical signals. Do not send names, emails, phone numbers, IPs, device fingerprints, biometrics, payment credentials, or raw vendor payloads. Vendor connections are not configured. OCDC displays deterministic triage points for human review; it does not verify identity, approve or decline payments, block accounts, or provide a chargeback guarantee.
Review queue—Tenant-local events
Priority—Analyst attention only
Needs attention—Normalized signals
Reviewed—Human assessments
Related transactions—Imported rows in Fraud & AML
Fraud cases—Existing OCDC case records
Loading provider connection status…
Analyst review queueLoading deterministic triage model limits…
Open investigation workbench ↗| EVENT | SUBJECT / TIME | SIGNALS | TRIAGE | REVIEW |
|---|---|---|---|---|
| Loading tenant digital-trust events… | ||||
OCDC product architectureAuthorized normalized event → tenant pseudonym → categorical signal rules → explainable triage queue → human assessment → optional explicit OCDC case link. Existing Fraud & AML, cases, graph, AI Defense, and Threat Knowledge remain separate linked capabilities. Commercial identity and fraud adapters are not configured in this build.
OCDC PRODUCT · CYBER-PHYSICAL PRODUCT SECURITY
Product security control plane
Join product and deployment inventory, component and CVE context, field evidence, product risk, and controlled update review across vehicles, robots, APIs, and OT edge systems.
Integration and safety boundaryThis build records tenant-local metadata and review decisions. It does not include an embedded prevention agent, verify firmware signatures, connect to vehicle or OT networks, certify compliance, or execute OTA, CAN, UDS, SOVD, robot, or controller commands. An approved update plan is governance evidence only.
Product assets—Tenant-local inventory
Components—SBOM metadata
Open product risks—Analyst-reviewed state
Critical risks—Exploit state stays explicit
Update plans awaiting review—No device update dispatched
01 · Product & deployment inventoryVehicle · ECU · robot · controller · API · edge
02 · Components & SBOM linksComponent identity · versions · vulnerability references
03 · Import and match an SBOMLocal CycloneDX 1.4–1.7 or SPDX 2.2–2.3 JSON
OSV sends selected package URLs and versions after confirmation. CISA downloads its public catalog after confirmation; only locally stored CVE references are compared. Both results remain unreviewed risk references.04 · Product risk registerCVE / threat context mapped to a tenant asset
05 · Controlled update governanceDigest-backed plan · independent analyst review
TENANT-SCOPED PRODUCT REGISTER
Product security records
Source references remain unverified until a connected provider or authorized analyst review establishes provenance.
| RECORD | PRODUCT / COMPONENT | RISK / STATUS | SOURCE / EVIDENCE | REVIEW |
|---|---|---|---|---|
| Loading tenant product security records… | ||||
Product architectureInventory & software-component registry → CVE / threat context → product risk & lifecycle evidence → analyst review queue → update-plan audit. Existing OCDC Automotive / VSOC, Threat Knowledge, Ontology, Graph, Cases, and Traffic Simulator remain linked workflows.
OCDC PRODUCT · PHYSICAL AI SECURITY · CAMERAS · ACCESS CONTROL · IOT · SMART CITY · DRONES · COMMS · SCADA / ICS
Physical AI Security
Protect the physical estate with the same platform that protects the network: cameras and video management systems, access-control readers and controllers, intrusion sensors, IoT and smart-city devices on any network (Wi-Fi, ZigBee, BLE, LoRaWAN, NB-IoT, LTE-M, 2G to 5G, satellite), traffic signals and transit devices, security gateways, drones and docks, communications links, and PLC / RTU / IED controllers. OCDC detects camera tampering, video loss and feed-integrity or synthetic-media suspects, forced or held doors, denied-badge bursts and tailgating, new or exposed IoT devices, and unauthorised controller writes or program changes, then correlates them by site into cyber-physical incidents.
AUTOMOTIVE / VSOC · AUTONOMY & VEHICLE VALIDATION
Autonomy validation & Drive Sim
Coordinate safety and cybersecurity requirements, operating domains, scenario references, validation results, and analyst-reviewed findings across vehicles, robots, and industrial machines.
OCDC DRIVE SIM · NATIVE SIMULATION, PLANNER, VALIDATION & DATA ENGINE
Native · readySimulate and validate driving scenarios
Run OCDC's own scenario simulator with the OCDC reference planner, sweep parameters against safety requirements, and record runs and findings in this workspace. Simplified kinematics for software-in-the-loop evaluation; nothing is sent to a real vehicle.
TRAFFIC SIMULATOR · FEED CONTEXT
Driving scenarios connected to all OCDC simulator feeds
Each run captures the current synthetic feed snapshot. Choose a profile to filter recent feed events; all feed families remain visible.
Loading simulator feed catalog…
Recent synthetic feed events
- Loading feed events…
ROAD NETWORKS · OPENDRIVE
Not loaded yetDrive a route through a road network
Choose a network, pick where the ego starts and where it goes, then run it through junctions and signals with other road users. Choose a behaviour model for the other road users below.
BEHAVIOUR MODELS · FITTED TO YOUR TRAJECTORIES
ReadyFit car-following and lane-change models
Published models (IDM, MOBIL) with parameters fitted to numbers you supply. Some tracks are kept back from the fit, and the error on those is what the table shows.
| Model | Data | Fitted by | Input digest | Tracks: fitted, kept back | Spacing error, fitted tracks | Spacing error, kept back | Published defaults, kept back | Lane change, kept back |
|---|
YOUR OWN SIMULATOR · RUNS ON YOUR SIDE
ReadyConnect your own simulator, models and metrics
Your simulator runs on your machines, fetches a scenario from OCDC and posts its numbers back. OCDC never runs your code, model files or containers. Results are labelled by where they came from.
How to connect a simulator
| Source | Who | Run of | Result | Data | When | Metrics |
|---|
REQUIREMENT TO TEST · READ · PROPOSE · A PERSON APPROVES · RUN · TRACE
LoadingFrom a written requirement to a simulated test
Paste one requirement. OCDC shows what it understood and what it could not, and proposes a scenario, a sweep and a pass criterion. You edit it and approve it, and only then can it run. The trail reads in both directions, and changing the requirement marks what came after it as stale.
Simulation results from an idealised model, not validated against real-world data.
Choose a requirement.
What this product doesOCDC provides the assurance and orchestration record plane around your existing simulator, data engine, autonomy stack, and test benches. It stores authorized metadata and evidence references; it does not execute physics or sensor simulation, train or deploy an autonomy model, control a machine, dispatch software, or certify safety or regulatory compliance.
Programs—Tenant-owned system scope
Scenarios—References and synthetic seeds
Validation runs—Imported result metadata
Active findings—Human dispositions
Requirements traced—Run-to-requirement links
Loading connected OCDC capabilities…
01 · Program & operating domainSystem boundary · owner · assurance references
02 · Scenario & requirement registryTrace scenario coverage to explicit requirements
Imports three labeled metadata references from the bundled simulator catalog; it does not import raw events or create validation results.03 · Validation result intakeAuthorized metadata · preserve version and evidence lineage
04 · Finding & assurance reviewHuman triage · no safety-critical action is dispatched
05 · Fleet operations eventAutonomy-stack / mission-control exports · collisions, near misses, cyber anomalies and high-severity events open a review
06 · Software release / OTA evidenceVehicle OS, OTA and model-update exports · signature status is source-reported; OCDC deploys nothing
07 · Data-engine log segmentDrive / sensor log metadata · OCDC stores no raw frames, point clouds or audio · training-ready needs a privacy-safe status
08 · Safety-case evidenceClaim, clause and evidence status against a standard · OCDC never asserts conformity or certification
09 · Read-only evidence importUp to 100 records for existing programs · all-or-nothing · re-running a batch is idempotent
Every record needs an externalId and an existing programId. One invalid record refuses the whole batch and names its index; nothing is dispatched to any vehicle, robot or system.TENANT-SCOPED ASSURANCE REGISTER
Programs, scenarios, requirements, runs, findings, fleet events, releases, log segments & safety-case items
Source claims, results, and reported coverage remain unverified unless an authorized reviewer establishes their provenance.
| TYPE / CREATED | PROGRAM / SCENARIO | RESULT / STATUS | SOURCE / TRACE | REVIEW |
|---|---|---|---|---|
| Loading tenant Physical AI evidence… | ||||
Product architectureProgram & operating domain → safety / cybersecurity requirements → scenario catalog → simulator and validation evidence adapters → versioned run results → requirement coverage and finding triage → case, product-security, automotive / VSOC, AI Defense, Ontology, Graph, and Brain links. OCDC provides its own simulation (OCDC Drive Sim), reference planner, validation toolset and data engine alongside the evidence and review plane.
P2 · INDUSTRIAL & ENTERPRISE TELEMETRY
OT / IoT data gateway
Bring read-only, timestamped telemetry and asset context into the same alert, analytics, and investigation workspace.
ManufacturingICS / SCADA metadataEnergy & utilitiesFleet & connected vehiclesEnterprise IoTRegular IT assets
| OBSERVED | ASSET / SECTOR | EVENT / METRIC | ZONE / PROTOCOL | SEVERITY | DETAIL |
|---|---|---|---|---|---|
| No OT/IoT telemetry imported. | |||||
TRANSPORT CYBERSECURITY · READ-ONLY
Fleet & transport security feed
Record cybersecurity events for vehicle, charging, routing, and fleet infrastructure. Asset/site metadata only; no individual tracking or vehicle control.
Transport events0Read-only metadata
| OBSERVED | FLEET ASSET | EVENT / SIGNAL | SEVERITY | DETAIL |
|---|---|---|---|---|
| No transport security events recorded. | ||||
AUTOMOTIVE & MOBILITY · CONNECTED OPERATIONS
Vehicle security, XIL validation & lifecycle assurance
Bring source-attributed vehicle, fleet, test-bench, diagnostic, and CSMS/SUMS evidence into OCDC cases, analytics, and investigations.
Safety and integration boundaryOCDC stores authorized results and metadata. It does not start PROVEtech or NetComm tests, connect to a bench, query a vehicle or ECU, send CAN/UDS/DoIP/SOVD commands, clear diagnostic codes, flash software, or control a fleet. Product cards describe portfolio references from the supplied decks; provider status stays unverified until a customer-authorized adapter is configured.
Vehicle cyber alerts0Source-reported · analyst review
XIL validation runs0Submitted result metadata
Diagnostic records0Read-only evidence
Lifecycle records0CSMS / SUMS evidence
Linked OCDC cases0Tenant-local references
OCDC VSOC · FLEET TELEMETRY & THREAT REVIEW
Vehicle Security Operations Center
Review source-attributed vehicle, telematics, backend/API, ECU IDS, and cloud audit events in the existing OCDC case, evidence, and graph workflows.
OEM / telematics / IDS feeds not connected Review alert queue ↗
Fleet safety boundaryCounts show records received by this tenant; they do not measure vehicle coverage or detection efficacy. This build has no live fleet feed and cannot issue vehicle, ECU, charging, or backend control commands. Analysts review every imported event before response.
Waiting for source-attributed VSOC records. No fleet data is assumed.
Record a fleet security eventAuthorized normalized metadata · source attribution required · creates an OCDC review alert and evidence item.
Analyst review · no response actionImport a CVE advisory for fleet triageStores advisory context in the automotive evidence register and tenant threat-intelligence search.
Manual / authorized importTISAX / VDA ISA EVIDENCE TRACKING
Record customer-selected edition, scope, control reference, evidence owner, status, and evidence pointer in the lifecycle form below. ENX controls assessment and label exchange. OCDC tracks evidence metadata and does not assess conformity or issue a TISAX label. ENX ISA2027 update ↗
VEHICLE SECURITY EVIDENCE FABRIC
Source lineage, freshness & connected records
Observed time and OCDC receive time stay separate. Freshness remains unassessed until a source-specific SLA is configured.
Loading current tenant evidence coverage…
DIGITAL VALIDATION & PRODUCTS · XIL
Test portfolio and validation evidence
PROVEtech, NetComm, AI-Core, and DVP Cloud references map to one OCDC result record, evidence link, and investigation trail.
Loading validation portfolio…
Validation servicesCustom validation · virtual testing · test consulting · one-stop testing
STANDARDS REFERENCES
ASAM XIL · OpenSCENARIO · OpenLABEL · SOVD · ISO 26262 · ISO 29119 · UNECE R155 / R156
Evidence references only; standards mapping and certification are not asserted.Loading integration path…
Record a test resultSaved results are indexed in OCDC evidence, analytics, and the relationship graph.
Metadata intake · no executionSOURCE-REPORTED RESULTS · CURRENT TENANT
Validation analytics
Compare MIL, SIL, HIL, and in-vehicle evidence; inspect result trends, failure concentrations, and traceability. Missing stage data stays marked as not observed.
Waiting for tenant validation results…
SERVICE 01 · VEHICLE SECURITY
Vehicle / fleet cyber alert
Capture a source-reported signal, preserve vehicle and ECU context, and create an OCDC review alert.
SERVICE 02 · DIAGNOSTIC EVIDENCE
Read-only diagnostic record
Index an authorized diagnostic observation in the vehicle timeline and OCDC evidence search. The SOVD connector accepts imports only; it never sends a request to the vehicle.
SERVICE 03 · CSMS / SUMS LIFECYCLE
Lifecycle evidence tracker
Track dated evidence coverage and gaps. This is a recordkeeping aid, not a compliance assessment or certification.
AUTHORIZED SOURCE INTAKE · JSON / BATCH
Import test, fleet, diagnostic & lifecycle evidence
Import one normalized record or a batch of up to 100. Supported: XIL results, fleet / VSOC alerts, read-only SOVD diagnostics, and CSMS / SUMS evidence.
SERVICE 05 · AI DIAGNOSTICS × CYBERSECURITY
ETAS diagnostic assessment intake
Import an authorized source-generated AI troubleshooting assessment. OCDC keeps the hypothesis, confidence provenance, limitations, recommendations, and evidence references together for analyst review.
Automotive record registerLoading tenant-scoped records…
| TYPE / RECORD | VEHICLE / PRODUCT | OBSERVED / SOURCE | STATUS / SEVERITY | CASE / LINK | DETAIL |
|---|---|---|---|---|---|
| Loading automotive records… | |||||
Authorized result intake
POST /api/ingest/automotiveBearer-authenticated normalized result metadata for alerts, diagnostics, CSMS/SUMS evidence, and MIL/SIL/HIL/in-vehicle results. Open the contract ↗. The SOVD profile is separate and import-only: POST /api/ingest/automotive/sovd, read-only diagnostic observations only, open SOVD import schema ↗. The ETAS-compatible source assessment importer is POST /api/ingest/automotive/etas-ai and has a separate assessment contract ↗. No provider connection is configured; OCDC makes no SOVD request and exposes no update/control operation.CONNECTED PRODUCT SECURITY · LOCAL ANALYSIS
Mobility & connected product analysis
Analyze supplied API logs, field-quality summaries, telemetry snapshots, and assessor-entered maturity levels. Each tool is stateless and labels synthetic examples.
Analysis boundaryThese tools do not capture traffic, connect to vehicles, ingest DTC/warranty/OTA feeds, issue vehicle commands, enforce API policy, or certify compliance. Submitted analysis payloads are not stored; OCDC persists only count-only audit entries.
01 · API SECURITY
API inventory & exposure
Compare access-log route templates with optional OpenAPI 3.x operations to flag shadow routes, unused operations, unauthenticated successes and 5xx rates.
02 · FIELD QUALITY
Issue prioritization
Rank submitted issue summaries using prevalence, severity, safety relevance, customer exposure and robust trend. Safety-related issues have a P2 floor.
03 · TELEMETRY SNAPSHOT
Asset silence & anomaly review
Check heartbeat silence and compare submitted metric samples with each asset’s robust baseline and a minimum three-peer cohort.
04 · READINESS PLANNING
Maturity & roadmap worksheet
Score 10 general and 2 automotive domains from assessor-entered levels, weights, targets, and evidence counts. High claims without evidence are flagged.
OCDC OT RISK MANAGEMENT · READ-ONLY INVENTORY
Asset posture, software & exposure
Store bounded inventory observations, configuration hashes, software/SBOM references, vulnerability identifiers, communication paths, and control evidence in OCDC’s own tenant-scoped records.
Collection boundaryImport reviewed exports or enter known metadata. This does not perform active discovery, fetch firmware/configuration, patch assets, or write to PLC/SCADA. Completeness depends on the source and collection method. Open asset snapshot contract ↗
Assets observed0No snapshots imported
| ASSET / SNAPSHOTS | SITE / OT LAYER | SUPPLIER / PRODUCT | SOFTWARE / SBOM | VULNERABILITIES | CONFIGURATION | PATHS / CONTROLS | CASE |
|---|---|---|---|---|---|---|---|
| No OT asset snapshots imported. | |||||||
OPM · SOFTWARE UPDATE CONTROL · P2 INTAKE / P6 CHANGE REVIEW
Patch planning & update control
Capture source-attributed Windows, Linux, application, driver, firmware, or configuration updates with asset impact, maintenance planning, pre-checks, rollback, and human review.
Review workflow onlyOCDC stores and reviews the update plan. Approval does not download, schedule, install, reboot, or execute anything. These plans take no results: what a client's deployment tool reports is recorded against an OPM campaign. No endpoint agent or vendor/package connection is configured. Open OPM and crypto audit ↗
Update plans & review decisionsTenant-scoped local records · approvals never dispatch software
Loading patch plans…
OCDC ENDPOINT EVENT WORKSPACE · P2 INTAKE / P3 SEARCH / P5 GRAPH
Endpoint event review
Bring authorized endpoint event metadata into case review, local triage, and the OCDC relationship graph.
01 Ingest source metadata02 Apply local review rules03 Link device, case & evidence04 Analyst reviews alert
SOURCE-BACKED REPORTING · LOCAL TENANT
Fleet posture & update reports
Summaries use imported report fields and source-submitted OCDC records. Missing fields stay unknown; no endpoint service or Intune tenant is connected.
Loading local report profile
Loading source-backed endpoint summaries…
Coverage denominator unavailable · freshness unassessed · no remote query or update action.
| OBSERVED | EVENT / DEVICE | USER / PROCESS | TRIAGE | CASE / EVIDENCE | |
|---|---|---|---|---|---|
| No endpoint events received. Add an authorized observation or configure the normalized OCDC endpoint feed. | |||||
Normalized OCDC feed
POST /api/ingest/endpointBearer protected with the ingestion token. Accepts 1–200 normalized records; contract: OCDC Endpoint Event v1 schema ↗. Imported records are deduplicated, tenant-scoped, case validated, and indexed in P5/P3. High or critical records and local keyword matches create review alerts.Acquisition and response boundaryOCDC does not install endpoint agents, query devices, capture command lines or process memory, acquire disk images, recover deleted files, or isolate/remediate endpoints. Local keyword rules are advisory; verify original source evidence. Imported event timestamps and provider status do not prove a live connection.
BRAIN · ONE PLACE TO TALK TO · HANDS WORK TO THE BOTS
AI Manager
Ask a question or give a task, by typing or by voice. The Manager splits it up and hands each part to the right bot, with your rights.
Your earlier requests
Loading…
BRAIN · CORE AI · SUPPORT FOR THE PEOPLE DOING THE JOB
Role bots
Loading…
Choose a bot.
INVESTIGATIONS · SOCIAL LINK ANALYSIS · METADATA ONLY
Communications network
Who communicated with whom across phone, SMS, WhatsApp, Telegram, email and social media, expanded hop by hop from a person in a case. Built only from lawfully obtained, case-linked communication metadata; message content is never stored or shown, and identifiers are masked unless an analyst reveals them (audited).
Select a case with communication records.
Movement
Built only from this case's records. Not live, no phone location, no camera tracking, and nothing about who this person was with.
Click a person on the map, then choose “Movement for this person”.
P2 / P3 / P5 / P6 · OCDC EVIDENCE & TEXT INTELLIGENCE
Evidence & text intelligence
One OCDC workspace for authorized evidence text, source lineage, case review, relationship context, and accountable handoffs across industries.
No case tasks.
Local keyword retrieval returns source-linked records. No generative conclusion is made.
Case-linked OSINT & social context
Authorized source references stay beside case evidence, with observed time, OCDC receipt time, review state, and relationship drill-through.
Select a case
Select a case above to load its linked OSINT and social-source records.
Case evidence & exports
No case evidence records.
Communications (CDR) timeline
No normalized CDR exports.
Chain of custody & examiner activity
No custody events recorded.
Forensic tool text-export adapter · OCDC evidence service
This OCDC-owned evidence service accepts a forensic tool's export manifest and up to 100 extracted-text records, under the authority the case records. It records source, export, item, processing-profile, custodian, case, purpose, and marking context, then makes the text available to local case search and analytics.
Boundary: this intake accepts extracted text and metadata only. It does not upload tool packages or binaries, acquire devices, run the tool's processing, or verify source-file/package hashes without the original bytes. OCDC verifies the submitted text hash separately.
Try the local exampleSynthetic records only. Loading the example does not import it or create tenant data.
No export submitted.Request contract ↗
Recent OCDC evidence batchesSource manifest metadata · tenant scoped
No OCDC evidence batches recorded.
Mobile forensic export contracts
Evidence intake route · see the API catalogueBearer protected. Send caseId, title, extracted text, collectedAt, and evidenceRef. Imported records are hashed and indexed by P5, then searched through P3; case-linked imports create a hash-linked custody event.Timeline intake route · see the API catalogueAccepts the same case-scoped text metadata plus normalized cdrRecords with eventAt, subject or counterparty, direction, durationSeconds, and locationRef. These records appear in the review timeline. No interception or device acquisition is performed.Licensed provider boundaryA provider's API and export schemas and tenant licensing are not connected in this build. This working slice accepts normalized authorized exports; raw mobile extractions, UFDR binaries, face matching, identity inference, and person-risk scoring are excluded.
CASE-SCOPED SOCIAL & OPEN-SOURCE WORKFLOW
Case source evidence
Add lawfully obtained, case-relevant source text with authority metadata, a content hash, and a custody trail. Open the OSINT reference register →
Collection boundaryThis case-evidence form accepts analyst-supplied text and authority-reviewed provider exports. The separate OSINT crawler checks only allowlisted public HTML pages, manually or on the tenant schedule shown in the crawler status while the OCDC service is running (configured target: ten minutes); it does not log in, crawl social profiles, intercept messages, identify people from images, infer real-world identity, or score individuals. Authority metadata is an internal review record, not a legal determination.
OCDC MEMORY ASSURANCE · L1–L7
Host manifest metadata workspace
Review externally acquired metadata and deployment readiness. OCDC does not acquire or reconstruct live host memory; kernel, disk, and process evidence require a separately qualified provider.
Local test dataCreates a signed synthetic manifest to exercise intake, chain validation, point-in-time metadata lookup, and feed export. It reads no host or evidence data.
Loading the OCDC memory capability registry…
P6 · PROVIDER AND MODEL OPERATIONS
Forensic capability delivery workbench
Track scoped implementation requests across acquisition, disk analysis, endpoint response, model training, and model serving.
Loading provider operation catalog…
No capability requests recorded.
P6 · POINT-IN-TIME MANIFEST METADATA
Explore stored manifest metadata at a point in time
Returns the newest stored manifest at or before the selected timestamp. The result contains metadata only.
Choose a host to inspect its stored manifest history.
MEMORY ASSURANCE REFERENCE · L1 THROUGH L7
Layer readiness map
DETECTION SCOPE
Threat and assurance coverage
| DEVICE / HOST | TIME | REGION | CONTENT HASH | OCDC CHAIN | SOURCE CLAIM |
|---|---|---|---|---|---|
| Loading snapshot manifests… | |||||
TIME-TRAVEL FORENSICS
Snapshot timeline, freezes and custody
Query any host's state at a time, compare two times, freeze a host for inspection and verify stored content.
EXTERNAL INTELLIGENCE · PUBLIC REPORTING
Cyber attack trends
Analyst-imported, source-attributed public statistics. Counts retain the publisher’s period, denominator and methodology.
Reviewed statistics import
POST /api/ingest/threat-landscapeFields: source, sourceUrl, period, publishedAt, count, denominator and methodology. Public-source samples describe reported incidents and are not a complete census or tenant alert baseline.No public trend records imported.
RESEARCH SNAPSHOT · VERIFIED 14 OCT 2026
Threat priorities
Public reporting describes the wider threat picture, not this tenant.
ENISA reports public administration as 32% of recorded targeted-sector cases; manufacturing 7%, transport 8%, and finance 6%. These are the report's incident set, not global prevalence.
ENISA Threat Landscape 2026 ↗M-Trends 2026 reports exploits in 32% of investigated intrusions, voice phishing in 11%, and a 14-day global median dwell time in its case sample.
M-Trends 2026 ↗Prioritize known-exploited exposure, tested offline backups, segmentation, and recovery procedures. OCDC can correlate submitted metadata; it does not patch, segment, or validate backup recovery.
CISA #StopRansomware Guide ↗ENISA expects emerging AI models to increasingly support malicious operations. Prioritize detection evidence, identity controls, and analyst-reviewed rule changes; OCDC does not autonomously create or deploy defenses.
ENISA report ↗HELP CENTER
Capability notes
Product service coverage is mapped to OCDC workflows, with live integration requirements kept visible.
XDR alerts can enter through JSON or CEF, then join OCDC analytics, correlation, and case review.
OCDC offers local evidence search and OpenCTI/XTIX mapping. Enrichment from a threat-intelligence provider needs an authorized API plan and credentials.
OCDC shows adapter coverage. Host isolation, network blocking, email actions, or malware detonation require the provider's licensed modules and an approved response connector.
OCDC PLATFORM
Architecture workbench
Follow source data through the analyst workflow and inspect which components are live.
Data to analyst workflow
Paths that run in this build are solid; external services are shown as connection targets.
- P2 · SOURCESProvider datathird-party · firewall · vendor feeds
- P2 · INTAKEValidate & normalizeAuth · timestamps · dedupe
- P5 · VECTORIZATIONIndex accepted recordsVendor alerts · evidence · OT/IoT · threat context
- P3 · RETRIEVALSearch evidenceLocal source-linked matches · provenance
- P4 · ANALYTICSModel assistanceRules · optional Foundry · review
- P5 · ENGINECorrelate & groupEntities · related alerts · cases
- P6 · OUTPUTAnalyst decisionsWorkflow · reports · STIX export
Working local sliceExternal setup or production work remainsP7 tracks security, reliability, and deployment readiness
OCDC-NATIVE ARCHITECTURE · LIVE LOCAL CROSSWALK
Platform capability map
Current OCDC code paths, tenant evidence, and delivery gaps. Architecture references inform the design; no vendor service or API is connected.
Loading OCDC platform capability states…
Collection counts are shown by family and are not deduplicated entities. Local, partial, and design-only states are kept separate. Live-source status reflects only source records explicitly marked verified.
P2–P7 · DATA, ANALYTICS & AI/ML
Data modules & model services
One inventory for cloud deployment profiles, collection modes, data classes, analytics modules, model maturity and optional security assistant integration.
Loading capability mapDownload Copilot API plugin template
Source-to-OCDC capability crosswalkCurrent market patterns, OCDC implementation evidence, specific gaps and native build priorities
Download OCDC 2021/2023 architecture audit and gap roadmap ↗Download agentic analytics gap assessment ↗Download data operations and API forensic audit ↗Loading map
Loading the source-to-code map…
Cloud deployment profilesTarget architecture · provider adapters are not live
OCDC's target architecture uses OCI-compatible containers, OCDC-owned PostgreSQL and graph interfaces, versioned ingestion, OIDC identity, replaceable object-store and queue adapters, and OpenTelemetry. These contracts are design targets; the runtime runs locally and is not cleared for production. Germany West Central and North Europe apply to the selected cloud platform profile only. Choose and qualify another provider profile per customer deployment.
01 · SOURCES
Customer data & sites
Security tools, approved datasets, cases, evidence references, and read-only OT site collectors.
02 · SHARED PRODUCT
TARGET DESIGNOCDC core engine
P1Identity & APIOIDC · tenant policy
P2IngestionVersioned adapters · validation
P5AI & vectorizationLocal rules · ATT&CK · search
GraphNative OCDC graphPostgreSQL schema · OCDC API
P6WorkflowsCases · evidence · investigations
P7OperationsAudit · telemetry · recovery
Shared contracts → provider adapters · OCI runtime · PostgreSQL · object store · queue · OIDC · OpenTelemetry
03 · DEPLOYMENT
Target profile per tenant
cloud platform · selected referencecloud platform · targetcloud platform · targetPrivate cloud / on-prem · targetdatabase vendor, technology vendor & others · adapter path
Each target needs its own deployment package, provider adapters, and qualification evidence.
Loading cloud profiles…
Collection pathsStreaming · batch · offline
Loading collection paths…
Supported data classesMetadata and normalized events in this build
Platform modulesP2 ingestion through P7 model and security operations
Loading modules…
AI and machine-learning catalogActive local functions are separated from design targets
Loading model catalog…
Responsible-use and operations controls
P5 · CORE ENGINE VECTORIZATION
Vectorization & evidence search
P5 normalizes and indexes all accepted vendor and platform records. P3 searches the resulting source-linked vectors; optional Foundry embeddings apply to alerts only, while evidence, datasets, and other integrations stay local.
One searchable evidence layer across connected sourcesEach adapter keeps its original provider and provenance. A source appears as indexed only after data is received and normalized.
Review vendor adapters DECISION INTELLIGENCE · P5 VECTOR DATAEVIDENCE PIPELINE · DEPTH CUES
OCDC-native and third-party sources
Every vector records its origin. OCDC-native: alerts, cases, Predictive SecOps, Crypto Intelligence, Cyber Ops network analytics, endpoint, OT, evidence and datasets. Third-party: XDR, EDR and NDR alerts, threat intelligence platform, threat-sharing platform, threat feeds, OSINT industry packs and optional automotive test sources. Both are searched together.
Loading per-source index coverage…
External threat context is indexed separately for analyst search and never treated as tenant detections. Raw video, biometric templates, device images, binaries, and source-file uploads are not sent to the vectorizer.
Import a dataset
LOCAL · 5 MiB MAXUpload a local CSV, TSV, JSON, JSONL, NDJSON, TXT, Markdown, LOG, or XLSX file. Rows are normalized and indexed for this tenant.
Local validation data & public source catalog
SOURCE REVIEW · 19 OCT 2026Choose a synthetic test pack for immediate local indexing, or open a publisher source to download a small, permitted sample. External references do not mean a feed is connected.
Public sources are manually selected and imported. Current live vendor feeds: none configured by this catalog. Synthetic packs are labeled in the dataset list and analytics; they do not create alerts, execute workflows, or connect to real assets.
Test-data map for all 14 solutions and 11 service groups
This catalog maps candidate local fixtures and public references for test planning. A mapping does not run a solution workflow. Suite results, workflow execution, and public-provider parity are reported separately.
Loading solution and service test-data coverage…
Loading publisher references and local fixtures…
Use Ctrl/Cmd-click to select multiple markings or permitted purposes. The primary purpose must be permitted. These labels travel with row lineage; per-user read enforcement is not available in this build.
Google Drive · test data
CHECKING SETUPConnect up to three accounts, then choose specific supported files from each Drive. No whole-drive scan or background sync runs.
Connect an account to choose files.
Selected content is downloaded in this browser and sent to the existing OCDC local dataset importer. OCDC makes no Drive edits or deletions. OCDC stores normalized rows and local vectors, discards source-file bytes, and enforces the existing 5 MiB / 2,000-row limits. Tokens are memory-only and expire; reconnect after reload. Choose only data authorized for this test tenant.
Gmail · selected-message test import
CHECKING SETUPRun one bounded Gmail search. OCDC reads at most 25 candidate headers, then fetches full content only for messages you select.
Google permission is read-only. The search returns at most 25 headers for review; up to 10 selected message bodies can be reviewed and imported. Attachments are not fetched. OCDC does not send, delete, label, or modify mail. Selected message content is saved as local tenant dataset rows only after the final import action. Token stays in browser memory and expires.
Google Analytics 4 · property report import
OAUTH SETUP REQUIREDConnect a Google account with read-only Analytics access, review daily channel aggregates, then import the approved snapshot into this tenant’s dataset and analytics index.
No GA4 report loaded. Connecting is read-only; no data imports until you review and approve a snapshot.
The report includes only daily date × default channel-group aggregates: sessions, engaged sessions, engagement rate, average session duration, events, key events and revenue. It excludes user IDs, email, IP address, user-level dimensions and event parameters. Google tokens stay in browser memory and are never sent to OCDC. Imported report rows are stored in the local tenant dataset and vector index after your approval.
Add evidence text to a case index
Intake API: POST /api/evidence. Each text item is SHA-256 checked and tenant scoped. Product connector workbooks are listed under Integrations.
P4 · DATA SCIENCE & ANALYTICS
Evidence-led analytics workspace
Adapt the information density, compare relevant KPIs, and turn current local data into repeatable, source-attributed insights.
Source freshness and tenant-record coverage unavailable
ALL OCDC DATA · TENANT-SCOPED
Collect · Clean · Transform · Analyze
Profile current OCDC records across connected workspaces. Analysis is read-only; refreshing does not trigger external data collection.
Awaiting tenant API
Source and record provenanceConnection checks and stored record origin are separate measurements. Open a group to inspect its source or data families.
Waiting for the tenant API. Counts are not assumed.
Recently verified connections —Unknown tenant-record coverage · source freshness is shown separately; recent checks do not guarantee records.
Waiting for the tenant source inventory.
Configured · not currently verified —Configured sources without a recent successful verification; never counted as live.
Waiting for the tenant source inventory.
Imported records —Explicit dataset/import provenance only. Select a family to inspect its OCDC workspace.
Waiting for imported-row counts.
Demo / synthetic data —— explicitly marked demo source entries · only flagged records are counted.
Waiting for demo-source status.
Waiting for demo-row counts.
Other local records and source states —Rows without explicit import/demo classification and sources needing setup or review.
Waiting for source status.
Waiting for other local record counts.
A source connection can be verified without returning data. Imported records do not establish a live connection. Unmarked local records remain unclassified; they are not assumed imported or live.
Governed metric contractsWaiting for the tenant metric catalog.⌄
Versioned definitions for the local aggregate profile, BI export, and cited analytics drafts. Local contracts are not certified business metrics; counts can overlap across source families.
Waiting for the tenant metric catalog.
Cross-sector data intelligenceDrill into the local record families that can support each OCDC sector workflow.
Mapped families · no sector feed impliedWaiting for tenant sector profile.
These are OCDC workflow mappings, not sector-tagged populations or coverage scores. Shared record families can appear under multiple sectors; live connections and synthetic, imported, and unclassified rows remain separately labeled.
Loading the four-stage analytics pipeline…
Dataset pipeline historyVersioned local imports · file and schema hashes · normalization and index outcome
Loading run historyLoading dataset pipeline runs…
Run history records metadata only. OCDC keeps the parsed tenant rows and vectors in local state; this is not a durable distributed scheduler or production lineage store.
OCDC data pipeline control planeVersioned local transforms · current lineage · health gates · reviewable release
Loading control planeAuthor bounded transformations over tenant datasets, preview through a local materialization, inspect lineage and data-health checks, then request a review before releasing the version into the local catalog. Derived rows retain source version, actor, purpose and marking metadata.
Open the pipeline API and implementation guide ↗
Loading pipeline and lineage inventory…
Lineage and temporal healthSource and derived dataset versions · current-parent fingerprint · refresh-based drift checks
Waiting for local dataset lineage.
Waiting for pipeline freshness and drift checks.
Loading runtime and model boundary…
Branches and pipeline runsRun-to-run quality and source-fingerprint drift are checked when this view refreshes.
Loading branches and runs…
Local change requests and review trailOCDC review requests are local records, not code host pull requests or production deployments.
Loading change requests…
Pipeline audit eventsActor-attributed creation, commit, run, review, merge, rebase and quality-feedback events from local tenant state.
Loading pipeline audit events…
Purpose is required and checked at run time; dataset markings are inherited and cannot be lowered by a branch. All write routes require the OCDC administrator session. This build does not yet provide per-user ABAC/read filtering, immutable audit storage, background scheduling, external PR creation, live source crawling, or LLM inference. Analyst feedback is recorded for review and does not train or change models.
Cross-service correlation & decision signalsMeasured relationship size and direction · compatible tenant records only · analyst review required
Loading relationship coverageLoading eligible source pairs and correlation coverage…
Numeric measuresPearson r and Spearman rho · analyzed within dataset and provenance cohort
Waiting for numeric correlation results.
Cross-family activityDaily UTC record counts · only dates observed in both families
Waiting for time-aligned source-family results.
Coverage, method and interpretation limits
Loading correlation coverage by OCDC service…
- Correlation is an association measure, not evidence of cause or action.
Shared decision workspaceTenant-scoped audit activity and live dashboard refresh channel
Event channel status pending—live dashboard sessionsSession counts indicate connected dashboards, not distinct people. Activity summaries omit actor identities and payloads.
Loading recent tenant activity…
Workspace changes trigger small refresh notices over the existing authenticated OCDC event stream. Decisions remain human-owned; no correlation automatically changes data, creates a case, or executes a response. Use the investigation, workflow, or review screens to record the decision.
Four analytics modesPast results, causes, validated forecasts, and reviewable next steps
Loading analytics modes…
Analysis methodsMethod availability depends on the fields and history actually present
Loading analytical methods…
Source-family coverageLoading OCDC record families…Inspect all sources
Imported dataset field profilePresence and distinct-value counts only; field contents are not returned
Loading dataset field coverage…
Reviewable recommendationsDeterministic readiness checks · no automatic changes
Loading follow-up actions…
Counts are source-family records rather than deduplicated entities. Current tenant data only.
Loading workspace KPIs…
Platform data footprintCross-solution counts from current local tenant recordsView details
Loading platform record counts…
These are record counts, not source-health or completeness scores. Graph and search totals are bounded local OCDC projections; external threat context remains separate from tenant detection. OT asset coverage is limited to imported observations.
DATA VISUALIZATION · SOURCE-BACKED
Explore signals, trends and outliers
Charts summarize the current tenant’s persisted records. Select a mark or source family to continue into its OCDC workspace.
Observed activityDaily record counts · explicit UTC timestamps · gaps are not interpolated
DESCRIPTIVE
Loading timestamped records…
Counts reflect records present in the local tenant for each date, not source uptime or total external activity.
Record footprintWhere current OCDC records are held
COMPOSITIONData integrityExplicit IDs, source attribution and event time
DIAGNOSTICLoading data quality…
These checks identify data gaps; they do not prove incident root cause.
Dataset distribution & outlookBinned numeric values and observed daily means; raw row values stay out of this view
ADAPTIVE VIEW · RULE-BASEDChoose a dataset and measure.
Choose a dataset and measure.
No forecast is shown until a measure has sufficient history and beats a held-out baseline.
Geographic signalExplicit coordinates only · coarsened 5° cells
MAPLoading coordinate coverage…
No location is inferred from a place label.
ANALYTICS RUNTIME · EXPLICIT PROVIDER ACTIONS
Loading runtime readinessCompute, BI exports, search, and model services
Check what is installed and configured. Model and provider calls happen only after an explicit administrator action.
Loading local Spark, local model, BI, Elasticsearch, and AI/ML readiness…
Spark is configured for bounded local rollups in the Docker runtime. The local LLM uses aggregate tenant metrics only and requires an explicit analyst request. Elasticsearch and external BI publishing still require their own destinations and credentials.
DATA SERVICES · SECURE QUERY SURFACE
SQL, direct read & semantic APIs
Query a bounded, read-only snapshot of this tenant’s OCDC records. Source and deployment readiness stay visible beside the data.
Loading SQL, semantic API, and deployment readiness…
Read-only SQL previewSELECT only · allowlisted tables · maximum 500 result rows
Queries are processed locally against the current tenant snapshot. Writes are disabled.
Run a query to inspect its bounded result and source tables.
Direct-read RESTPaginated direct-read API · independent of Spark runtime
Direct read returns only current local tenant rows and carries no live-source claim.
Choose a view and load its first page.
Spark is an optional bounded aggregate job; BI JSON/CSV export is local. Elasticsearch requires a configured destination and successful check. JDBC/ODBC listeners, external BI publishing, semantic writes, and Kubernetes autoscaling are not active.
MODEL-TO-INSIGHT
Build a reusable decision artifact
The default output uses deterministic aggregates and the latest loaded OCDC model result. Optional local or hosted LLM analysis sends only the analyst question and aggregate metrics, and returns a reviewable draft.
Insight preview
Refresh analytics and add a decision question. The local draft is deterministic; the local model runs only after verification and an explicit analyst request.
DEEP RESEARCH
Structured research brief
Prepare a source-grounded plan for market analysis, regulatory review, literature comparison, or long-document synthesis.
Research readiness
This prepares a reusable research specification only. External source retrieval, long-context document synthesis, citation verification, and latency targets are not configured in this build.
Reusable preparation pipelineEach stage links to its OCDC surface and current implementation boundary
P2 → P5 → P4 → P601 · PrepareValidate source schemas, tenant, timestamps, and identifiersData modules →02 · UnifyNormalize and index approved, provenance-linked recordsVectorization →03 · AnalyzeInspect deterministic rules and model outputs with their limitsModel catalog →04 · ReuseExport the reviewed insight definition and aggregate snapshotReports →
The pipeline is an analyst workflow in this build. Scheduled feature engineering, production model deployment, shared artifact storage, and automated approval are not configured.
P4 · AI BRAIN & CORE ENGINE
OCDC AI Brain
Detection models, behavior signals, breach-intelligence context, and human-approved capability proposals in one governed workspace.
LLM configurationSecret-free runtime validation · does not call the provider
Loading hosted model configuration…
OCDC native AI runtime & model readiness
Checking
Reading local model, knowledge-layer, and connector states…
Hosted provider healthManual live request · enabled paths only
Provider status has not loaded.
Local model drift monitoringFive-minute local check · no weight or release changes
Model monitor has not loaded.
Native capability mapOCDC functions are first-class capabilities; integrations supply data to them
Loading native capability states…
Model lifecycle workflowHuman-gated stages · no online self-training or automatic promotion
Loading workflow stages…
OCDC local classical model workbenchNaive Bayes + numeric logistic classification · clustering · regression · anomaly profiles · human release
Tenant-local registryModel state is separate from the AI relationship graph and connector state
Loading local model registry…
Identity-sensitive use governanceGovernance metadata only. This build does not collect biometric templates, perform face matching, identify people, search watchlists, track individuals, or make legal decisions.
AI security posture & threat controlsCode-backed crosswalk · refreshed with the five-minute local validation
Maps current OCDC safeguards and gaps to NIST AI RMF and the OWASP LLM Top 10 (2025). This is a self-review, not an independent assessment or certification. NIST’s Cyber AI Profile is still preliminary.
Loading AI security posture…
NIST AI risk-management functionsGovern · Map · Measure · Manage
OWASP LLM Top 10 (2025)Application risks and visible OCDC safeguards
Reference baselines: NIST AI RMF ↗ · NIST Cyber AI Profile draft ↗ · OWASP LLM Top 10 ↗ · Open full source-to-capability assessment ↗
AI, ML, deep learning & generative AI relationshipsField hierarchy and OCDC implementation state
AI is the umbrella. ML is a subset of AI; deep learning is a subset of ML. Rules/expert systems are AI but not ML. Generative AI describes a content-generation application class and can use foundation models; it is not a separate learning paradigm.
Loading AI taxonomy…
Interactive relationship mapDirected links distinguish hierarchy, learning paradigm, architecture, and common implementation
Loading validated AI relationships…
Select a relationship to inspect its meaning and the OCDC implementation state.
MITRE ATT&CK active knowledge base Verifying local STIX bundle…
Versioned Enterprise, Mobile, and ICS ATT&CK STIX 2.1 objects are searchable locally. OCDC rule links are curated references resolved against this knowledge base. MITRE strategy text is not executable detection logic, and mapped rules do not imply full ATT&CK coverage.
OCDC rule mapping coverageTechnique → tactics → detection strategies → analytics → data components
Checking local mappings…
Search the active versioned knowledge base to inspect ATT&CK objects.
Machine-learning families & deep-learning architecturesArchitecture catalog · implementation status is explicit
Learning approach, model architecture, and vendor service are tracked separately. An architecture becomes a working OCDC model only after governed data, evaluation, deployment, monitoring, and human release approval.
Deep-learning architecture optionsFeedforward · CNN · recurrent · transformer · generative · graph
Loading architecture catalog…
Classical machine-learning familiesSupervised · unsupervised · reward-based
Loading ML families…
AI model-service lifecycleImplemented controls are separated from deployment gates
Loading AI service lifecycle…
Learning loop: source-attributed breach intelligence + analyst feedback → proposed detection coverage → human approval → read-only local detection.
Core engine model catalogActive local capabilities and external model adapters
Loading core models…
Normal / abnormal behavior signalsLoading observed behavior…
AI Brain capability proposals
Visual integrity & physical-security signalsProvider adapter contract · metadata only
No provider events received. Adapter route: POST /api/ingest/physical-security
Safety boundaryVideo intelligence is limited to licensed-provider integrity and scene-event metadata. No camera footage, face recognition, biometric matching, watchlist search, identity inference, person tracking, law-enforcement/legal decision, autonomous code generation, or response action is performed by this build.
ADVISORY MODEL OUTPUT
Evidence-bounded triage. Review source records before acting.
No model analysis run yet.
Configured mode: local heuristic until a Foundry endpoint is configured
OCDC AI BRAIN · GROUNDED PLATFORM CONTEXT
What the Brain can rely on
Tenant-local capability and coverage context from the same architecture map. This status informs the operator view; it does not add an LLM or autonomous agent.
Loading local Brain context…
P5 · ORCHESTRATION
Core engine run
Run reviewed local rules across tenant alerts, evidence, OT/IoT, physical-security, detonation, forensic, communications timeline, case, and custody records. Results are advisory; no automated response.
Ready to evaluate the current tenant’s normalized solution records.
P5 · BRAIN CORE ENGINE · GROUNDED ANSWERS
Sign in to use the BrainAsk the tenant's data — every claim cites a record
Built on published patterns for grounded AI search (grounding supports, query fan-out, Deep Research plan→search→iterate, requires-action pauses, cached prefixes) and a research-assistant product (own the retrieval layer, hybrid candidates, multi-stage ranking, structured citations, approval-gated tools) — applied to OCDC's private records only. Retrieved text is screened by AI Defense; no hosted model is called unless configured and verified.
Recent runs and evaluations
How the engine is built (pipeline and the lessons it borrows)
CORE ENGINE · P6 API MANAGEMENT
LoadingCore Engine: where every ML and language-model component lives
The OCDC platform reaches the Core Engine only through its API Management layer (P6). Inside it: the LLM data pre-processor, the context processor (RAG, the Brain Core), registered Python analyses, the local and hosted language models, internet learning (WEB), feature extraction and security prediction (the AI Core) and contextual reports. No arbitrary code runs and the Core Engine never rewrites or deploys its own code.
P6 · vectorization data feeding the Core Engine
Core Engine API (API Management)
AI CORE · BRAIN CORE · ACTIVE LEARNING
Sign in to see Active LearningAlways learning: threats, products, industries, models and OCDC itself
A scheduler keeps the AI Core (OCDC-CLM) and the Brain Core current without anyone pressing a button. It fetches threat intelligence and product/solution news from approved internet sources, checks each client's products for known-exploited CVEs, writes protection briefs for every industry, retrains the model behind an evaluation gate and asks analysts about the events it is least sure of. Fetched content is untrusted data and never acts on client systems.
CORE ENGINE · CONTEXTUAL REPORTDaily learning digest What OCDC learned in the last day and what needs a person. Compiled daily by the Core Engine; urgent items alert immediately.
Loading the latest digest…
Digest history
| Job | Last run | Status | Next | Result |
|---|---|---|---|---|
| Loading… | ||||
AI Core model versions (OCDC-CLM)
Teach the model · least-certain events
Client product exposure
OCDC platform self-posture
Industry protection briefs
Feeds and boundaries
Learning lanes · Core Engine WEB (internet learning)
The Core Engine's WEB component learns, from verified public sources, what is new for every OCDC product, solution and industry. Knowledge is added to the learning catalog automatically as untrusted, source-attributed items; anything that would change detection or decisions becomes a proposal for the Core Engine's "Make a Security Prediction" catalogues, which a person accepts or dismisses.
Loading learning lanes
New items this week · lane × industry
| Loading… |
Proposals to review
Latest items per lane
CORE ENGINE · AI CORE · BRAIN CORE
Sign in to see the registryCore Engine › Model & knowledge registry
Where the model and the knowledge are kept, and who owns them. The AI Core (OCDC-CLM) is a small self-trained model, not an LLM: every version is a SHA-256-checked weights file with a model card. The Brain Core does not train; it retrieves from the records listed below and cites them.
Accountable model owner
AI Core versions · model cards · integrity
Brain Core knowledge inventory
OCDC-NATIVE ENGINEERING LAYOUT
Core services, model families & data flow
Local implementation, runtime requirements, and provider connection state are shown separately. Configure and verify each external path before treating it as connected.
Loading model registry summary…
- Loading OCDC service layout…
Model family readinessAlgorithm availability is separate from tenant-trained models and active weights.
Open AI Brain & model workspace →Loading model-family status…
Current implementation boundaries will appear with the architecture response.
BRAIN · P5 PRODUCT
OCDC Brain & Core Engine orchestration
Source-grounded security research and guarded threat learning across cyber, crypto, AI, cloud, endpoint, API, OT/ICS, automotive, and communications records.
Loading tenant-scoped product status…
Five-minute product and capability watchBounded scan of this tenant's approved public sources · candidates require administrator review
Loading Brain product-watch status…
Crypto scam patterns and prevention cuesPublic-awareness intelligence · indicators are leads for review, not legal findings
Loading scam-prevention guidance…
Intelligence source catalogSource attribution · access boundary · tenant-tagged record counts
Loading research sources…
Five-step threat learning loopGuarded content workflow · no self-modifying production code
Loading learning controls…
AI model, research-assistant, ontology, SIEM, AI security, identity, and fraud product comparison
Loading public product patterns…
OCDC product gap assessment and next build priorities
Loading product gaps…
Research and implementation boundaries will appear with the Core Engine response.
DELIVERY TRACK
P1–P7 phase map
What runs today and production readiness are tracked separately.
Loading live readiness…
OCDC DELIVERY TRACK · WHAT RUNS TODAY7 PHASES
P7 · EVIDENCE-BASED ASSURANCE
Security program assurance
Map OCDC capability evidence to NIST CSF 2.0 and SOC-CMM domains, then record a current/target profile with your evidence.
Assessment boundaryThis is a product capability and pilot assessment aid. It does not assess or certify your organization, and it creates no automatic maturity score. SOC-CMM response options vary by question; only record outcomes supported by your evidence.
Loading assurance evidence…
Read-only checks cover API health, alerts, analytics, retrieval, core-engine state, AI catalog, and production readiness.
FORENSIC REVIEW · 19 OCT 2026
Production readiness not establishedKey findings
Source-backed audit snapshot. These findings are not live runtime telemetry; use the checks above for the limited checks currently available.
HIGH
Identity and tenant isolation
Process-local administrator sessions and one tenant ID per runtime. Readiness marks OIDC/shared sessions and tenant isolation as blocked. Application filters do not prove production isolation.
Review deployment controls ↗HIGH
Durability and recovery
Application state uses local JSON and the graph projection uses SQLite. Transactional storage, durable queues, protected audit/evidence storage, backups, recovery, and high availability remain open.
Review delivery phases ↗HIGH
Source and release integrity
The local mirror is unreconciled and uncommitted. code host draft PR #1’s recorded workflow failed HTTP smoke checks because the ATT&CK bundle was missing; container build and provenance jobs were skipped.
Review release readiness ↗MEDIUM
Graph and AI claims
The relationship theatre is an interactive 2D SVG with simulated depth; undated ordering is illustrative. Local AI is classical/advisory; active foundation-model weights or production inference were not confirmed.
Inspect graph view ↗Inspect model catalog ↗HIGH
Credential follow-up
An earlier audit recorded a monitoring credential in diagnostic output. Rotation or revocation was not verified. No credential value is displayed here.
Review assurance evidence ↗Source checks passed161 Python tests · Python compilation · JavaScript syntax
HTTP smoke unverifiedThe sandbox blocked the test socket before assertions ran.
Runtime and deployment unverifiedPorts 8080/8081 and process inspection were unavailable; Docker access was denied and gcloud was unavailable.
code host workflow failedHTTP smoke failed; image build, JavaScript CI, and provenance jobs were skipped.
This snapshot does not confirm that the currently open dashboard process has loaded these findings or that a cloud deployment is healthy.
NIST CSF 2.0 functions22 mapped categories · current CSF 2.0 alongside the workbook’s legacy CSF 1.1 reference tab
Capability evidence and Current / Target profileOCDC implementation evidence is separate from an organization’s assessed outcome
Loading mapped capabilities…
TACTICAL SECURITY OPERATIONS FRAMEWORK · OCDC CROSSWALK
Operational assessment readiness
Compare the supplied TSOF framework with OCDC’s actual evidence paths and current security guidance.
Assessment boundaryThis view maps requirements and identifies gaps. OCDC did not scan, exploit, disrupt, or alter any system. Supporting records are context for an authorized reviewer, not proof that a control passed a test.
METRIC VALIDATION GATE
ODS is not calculated in OCDC
The supplied PDFs do not give one reproducible definition: their operational-friction formulas differ, the phase-two name changes, and the control-counting, evidence, and weighting rules are not fully specified. The score is not independently validated, so OCDC will not present it as a measured risk or ROI result.
Read the detailed audit ↗ATAC · FOUR-PHASE REFERENCE
Assessment cycle
TSOF · TEN TACTICAL CONTROLS
Control concepts mapped to OCDC
EXTERNAL CROSS-REFERENCE
Standards and regulatory fit
Technical assessments require an agreed plan for authorized scope, permitted and prohibited activity, contacts, data handling, and incident handling. OCDC has no executable red-team plan or ROE workflow.
Open NIST assessment guide ↗Incident response is integrated throughout CSF 2.0 risk management. OCDC has local incident and evidence workflows; exercise evidence, recovery outcomes, and production operating controls remain gaps.
Open NIST incident-response guidance ↗Zero trust focuses on resource access and identity; network location alone does not establish trust. TSOF’s assume-breach theme is related, but it is not a complete zero-trust design or validation.
Open NIST zero-trust guidance ↗DORA TLPT obligations apply to financial entities selected under defined criteria. NIS2 assigns management-body approval and oversight duties and may impose liability under applicable law; TSOF does not establish a general liability shift or regulatory assurance.
DORA ↗NIS2 ↗DORA TLPT technical standards ↗P2 / P6 · THREAT INTELLIGENCE INTEROPERABILITY
OpenCTI & XTIX data framework
STIX 2.1 object catalog plus the XTIX investigative profile field map from the supplied workbooks.
OpenCTI native model mappingOCDC alerts sync as native STIX Notes with searchable labels and a structured OCDC payload. The XTIX compatibility contract maps people and organizations to Identity, evidence to Artifact/File plus Notes, and communications to native observables or reports. These mappings work with stock OpenCTI; they do not create separate first-class XTIX entity types. Workbook sample records remain reference material.
Framework scopeThe announcement deck frames XTIX around people, organizations, witnesses, victims, threat actors, and physical or digital evidence. Its compliance, adoption, pilot, and comparative-performance claims are not shown as verified product facts.
STIX 2.1 object catalog
Proposed custom types from the STIX workbook
XTIX police profile fields
Sensitive fields are marked in the catalog. Keep sample values out of production and apply purpose, access, retention, and disclosure controls before storing real case data.
P2 INTAKE · P5 TYPED GRAPH · P6 REVIEW
Intelligence operations
Source-attributed intelligence, FIMI review, priority-led hunting and intelligence-informed validation plans in one tenant-scoped workspace.
Evidence boundaryImported intelligence is context, not a verified tenant detection. OCDC does not infer attribution or truth, poll feeds automatically, or execute BAS activity. threat intelligence platform’s current adapter is outbound STIX push; threat-sharing platform status reflects its configured API check.
Loading source and graph counts…
Loading connector provenance…
OCDC-NATIVE · LOCAL ALERT REVIEW
Signal Review Fabric
Explainable queue ordering over alerts already in this tenant. Source severity, event time, and exact-entity recurrence stay visible.
Loading local queue
Heuristic review priority only · no prediction, provider pull, identity resolution, model training, alert mutation, or automated response. Missing event timestamps remain unknown. Review runs are bound to the displayed queue snapshot; local history is capped and shows any evictions.
Loading signal summary…
Review priority distributionClick a band to filter the queue
Waiting for the local alert snapshot.
Analyst queueCounts are tenant-scoped.
Waiting for the local alert snapshot.
IMPORTED CONTEXT · NOT A DETECTION
0 recordsSource records
Click a record to locate it in the native OCDC graph or source register.
No imported intelligence or OSINT records are in this tenant yet.
ANALYST-OWNED · DRAFT / REVIEW
Create an intelligence plan
Plans are stored locally and linked to selected OCDC records and cases.
TRACEABLE PLAN HISTORY
Open typed relationship graph ↗Review queue
Review notes capture an analyst disposition; a reviewed validation plan remains unexecuted.
No intelligence plans saved.
P2 / P5 · PUBLIC THREAT INTELLIGENCE
Cisco Talos · Threat Source
Read-only Talos blog RSS metadata as analyst-reviewable OSINT references, with the official reputation lookup one click away.
Loading Talos source status…
Source and data boundaryOCDC reads only article titles, official URLs, publication dates, and categories from Cisco Talos Threat Source ↗. It does not call an undocumented reputation API, scrape the lookup UI, fetch article bodies, extract IOCs, create detections, or poll automatically. Reputation searches are analyst-led and subject to Talos rate limits. Imported references remain unreviewed until an analyst records a disposition.
Imported article references
Tenant-scoped source metadata · article content is not stored
No Talos article references imported.
No feed check has run in this tenant.
P2 / P5 · AUTHORIZED THREAT INTELLIGENCE
MISP feeds & indicators
Connect an authorized MISP instance, inspect its feed catalogue, and bring published indicators into OCDC’s searchable intelligence context.
Feed and data boundaryOCDC reads the feed catalogue and published events from your configured MISP instance. MISP feed sources must be enabled and fetched in MISP according to each provider’s access terms. OCDC does not turn on every source, fetch provider feeds directly, download attachments or samples, or convert indicators into detections. Imported `to_ids` indicators remain source-attributed, preserve MISP tags and TLP markings, and are search-only context.
Checking MISP connection configuration…
Feed catalogue
Metadata visible to OCDC’s read-only MISP account. MISP may hide other entries when lookup visibility is off. Disabled entries are shown; a feed is fetched only after it is enabled in MISP.
| Feed | Provider | Format | Transport | State |
|---|---|---|---|---|
| Connect to a configured MISP instance to load its feed list. | ||||
A sync reads up to 500 published events per run. Re-run with the next page range to continue through a larger result set.
OCDC CYBERSECURITY OPERATIONS · CROSS-DOMAIN REVIEW
Security signals, dependencies & analyst review
Review minimized, source-attributed metadata across Network, Identity/SaaS, Cloud, Endpoint, and Email. Data coverage reflects imported tenant records only.
Loading local workspace
Loading cybersecurity operations…
OCDC NETWORK ANALYTICS · NATIVE NDR
LoadingNetwork analytics
OCDC's own network detection and response over firewall, flow, Zeek, Suricata, proxy and DNS records: scans, lateral movement over admin protocols, beaconing, DNS tunnelling, exfiltration volume, first-seen destinations, IDS signatures and compliance (cleartext protocols, exposed RDP, outbound SMB). Other network detection products are optional connectors whose exports feed the same analytics.
Decision boundarySource signals and OCDC rules create review candidates. Source reachability, verified feeds, trained models, causal root cause, and response dispatch are not inferred from local records.
FIVE DOMAIN COVERAGE
Imported records by domain
Loading domain coverage…
EXPLICIT DEPENDENCIES · SOURCE ASSERTIONS
Topology and impact review
Edges are created only from exact imported entity IDs and dependsOn references within the same tenant, source label, and environment. Click a node to inspect it.
Loading relationship counts…
Select a node to inspect its source-attributed metadata.
Relationship records · accessible table
| Entity | Domain | Source / environment | Explicit references | Records |
|---|---|---|---|---|
| Loading relationship data… | ||||
HUMAN REVIEW · NO AUTOMATED ACTION
Detection and impact candidates
Deterministic exact signal matches, robust baseline deviations, and explicit upstream review candidates.
Loading analyst queue…
OCDC rule candidates
No cybersecurity candidates recorded.
Baseline deviations
No metric candidates recorded.
Upstream dependency review
No dependency candidates recorded.
Metadata intake
Operator-attributed, typed records · no raw events, packet contents, email bodies, credentials, prompts, or responses
OCDC detection catalog
Loading deterministic review rules…
Loading OCDC rule catalog…
Network detection reference · 1,377 catalog entries
This workbook is a background analysis catalog of one network detection product's models, not an API inventory or an imported OCDC detection pack. OCDC does not turn its rows into 1,377 endpoints or claim parity with that product.
1,377 model rows1,305 active in source export72 disabled in source export2,689 XML components356 distinct signal labels45 categories
Network 932Identity / SaaS 224Cloud 135Endpoint 80Email 6
OCDC currently exposes 18 first-party deterministic review rules (three shared conditions plus 15 normalized domain event types). They are OCDC-owned, source-metadata rules; they are not copied vendor models, trained detections, or effectiveness claims. A configured connector to that product stays limited to its documented read and import workflow.
The local state store is JSON and provider state is separate from tenant-record coverage. This workspace does not provide continuous telemetry collection, source-side execution, automated service discovery, validated predictive models, deterministic causal root cause, or response dispatch.
OCDC PREDICTIVE SECOPS · PARSERLESS INGEST · SIGNALGATE · MULTI-MODE DETECTION · PREDICT & PREVENT · ASO
Predictive SecOps
Logs in any format become OCDC records without parsers. SignalGate decides what is worth analysing, archiving or folding away; rules, behaviour baselines, network analytics, threat intelligence and attack-narrative similarity raise detections; related detections become scored cases on a five-phase kill chain; and the forecast shows where each attack is likely to go next and how to stop it. Responses are requests that a second person approves.
Select a case.
SignalGate policy
Learned log templates
Automated hunts
Attack narratives (behaviour similarity)
OCDC never executes a response itself. An approved request is delivered to the tenant webhooks subscribed to response.approved (your firewall, EDR, identity or SOAR automation) and recorded in the audit trail. The requester cannot approve their own request.
YOUR ACCOUNT · TWO-STEP SIGN-IN
Account security
Protect your account with a code from an authenticator app in addition to your password. The secret is stored encrypted; recovery codes are shown once and stored only as hashes. Turning it off requires a current code.
OCDC DEFENSE MEASUREMENT · ENCLAVE SCORING · ASSUME BREACH · EMPIRICAL OVER INTENT
Defense Measurement
Measure each enclave instead of colouring a risk matrix: attack surface (exposures, interaction points, implicit trusts), operational friction (leaks, deviations, process gaps, control failures, breaches) and verified defense controls give an Operational Defense Score per enclave, rolled up by business criticality. Findings need evidence; OCDC suggests them from its own records and an assessor accepts them. Compatible with the Tactical Security Operations Framework (TSOF) metrics.
Board view: enclaves ranked by ODS
OCDC CRYPTO INTELLIGENCE · INVESTIGATIONS · TRANSACTION MONITORING · SCREENING · ON-CHAIN THREATS · SCAM PREVENTION
Crypto Intelligence
OCDC's own blockcrypto intelligence over this tenant's transfers and labels: heuristic clustering, direct and indirect exposure by risk category, address screening, tracing with a storyline, on-chain threat rules and pre-payment scam checks. Labels come from OCDC Threat Knowledge (sanctions, scam, phishing and drainer feeds) and the tenant's own declarations; nothing is frozen, blocked or reported automatically.
On-chain threats
OCDC AI SECURITY OPERATIONS · AI SYSTEMS ONLY
Monitor AI models, applications, agents & tools
Review source-attributed inventory and minimized runtime metadata. This workspace does not collect prompt/response bodies.
Loading local workspace
Loading AI security operations…
Connection and decision boundaryGeneric normalized intake is available; provider adapters are unverified. Detection candidates are advisory. Blocking, isolation, rollback, and other external response actions are not dispatched.
Observed technology coverage
Tenant records only · not provider connectivityLoading observed coverage…
BEHAVIORAL REVIEW · SOURCE-REPORTED METADATA
AI agent activity baselines
Sample-gated review of imported request counts for an exact source, agent, event type, environment, and declared time window. User/device/network baselines and trained UEBA are not configured.
MethodA robust median/MAD candidate requires at least eight prior operational samples. A candidate is not an alert, policy breach, identity assertion, or automatic response.
Loading agent behavior cohorts…
Review candidates
Loading candidate review…
MODEL QUALITY · SOURCE-REPORTED LABELS
AI model calibration review
Compare reported uncertainty with later source-reported outcomes for an exact source, model ID, version, technology family, and environment.
Method and boundaryAt least 32 labeled outcomes are needed for an ECE diagnostic; a drift candidate compares two 32-outcome windows. Labels are not independently verified and do not train, calibrate, release, or change a model.
Loading model calibration diagnostics…
Calibration review candidates
Loading calibration review…
EXPLICIT LINKS · TENANT-LOCAL RECORDS
AI systems relationship field
Shows up to the newest 10 eligible events and 15 review candidates linked to those events. Asset connections are unverified assertions requiring an exact model ID and source label; source labels do not prove identity. Finding edges show stored event references. No name, time, similarity, causality, or attack-chain links are inferred.
Source freshness unknown · 0 verified live feeds
Loading relationship counts…
Exact source label · identity unverified Inventory asset · unique exact source label and model ID assertion AI event metadata Review candidate · linked by event ID
Select a graph node to inspect its stored metadata references.
Relationship records · accessible table
| Type | Record | Details | Explicit relationships | Data state |
|---|---|---|---|---|
| Loading relationship records… | ||||
Synthetic scenario catalog · 10 taxonomy-based test cases
Public taxonomies guide test design; the rows loaded into OCDC are fictional metadata fixtures, not public incidents, raw benchmark prompts, verified attacks, or effectiveness results. The linked incident datasets and model benchmarks are research references only; they are not imported as telemetry or evidence of OCDC detection performance.
Loading scenario catalog…
APPLICATION HEALTH · TRACE / METRIC / LOG / CHANGE METADATA
AI application observability
Explore imported service relationships and operational measurements across frontend, gateway, orchestration, retrieval, model runtime, and database spans. Exact trace parents and source-declared database spans create links; no relationship is inferred from names or timing.
Loading · freshness unknown
Collection stateManual import and opt-in, bearer-authenticated OTLP/HTTP JSON are available. An optional Docker profile defines an OTLP gRPC/HTTP Collector with minimized export and a local disk retry queue; its runtime state is not verified here. No source is verified by default.
Loading imported observability records…
Imported service map
Trace-parent and reported database dependency edges
Loading explicit links…
Latency, errors & change context
Observed span percentiles are not an SLO or availability verdict.
Loading service measurements…
Statistical review candidates
Loading candidate analysis…
Metric history & deployments
Imported scalar samples only · series are separated by source label, authenticated importer, environment, and version · importer references are pseudonymous · temporal aggregation and sampling completeness are unknown · deployment markers are source-reported.
No imported time series is available; source freshness remains unknown.
Deployment markers · imported records
Loading deployment records…
Service measurements · accessible table
| Service | Unverified source / importer ref | Role / environment | Spans / errors / logs | Imported sample p50 / p95 latency | Versions |
|---|---|---|---|---|---|
| Loading service rows… | |||||
Import minimized OpenTelemetry-shaped metadata
Manual, tenant-scoped import of allowlisted summary fields only. Raw prompts, responses, log bodies, SQL text, stack traces, headers, tokens, and arbitrary attributes are rejected. Exact replays are idempotent within the authenticated importer and source scope; reusing an event ID with changed content in that scope is rejected. Different importers are not automatically deduplicated. This is not an OTLP endpoint.
AI inventory
Models, apps, agents, RAG, MCP tools and runtimes
No AI assets recorded for this tenant.
Source-side telemetry
Allowlisted metadata only · no prompt or response text
Recent source events
No AI telemetry events imported.
Detection engineering & analyst triage
Natural-language descriptions produce constrained, deterministic drafts.
No AI security findings recorded.
Metadata hunts
Search imported events across normalized AI technology families.
No hunt has run in this tenant.
Generate a review report
Reports summarize tenant-local source metadata and review findings. Synthetic records are excluded unless selected.
Generic intake can normalize sources that map to OCDC AI telemetry metadata v1. Vendor-specific adapters, 300+ verified technologies, continuous monitoring, a deployed endpoint agent, production inference, and independent detection validation are not established by this local workflow.
OCDC ANALYSIS WORKBENCH
Analyses and run history
Run deterministic analyses and seeded simulations on records you supply. Each run is saved for this tenant with a digest of its input. Outputs are triage aids, evidence checks and synthetic model results, not audits, certifications, safety validations or release approvals.
Loading the latest runs…
Input
Paste JSON in the documented shape. A sample loads when you pick an analysis.
Result
Run an analysis to see its result here.
Raw JSON
Saved runs
Newest first, up to 20. Open a run to review its result again.
Loading saved runs…
SYNTHETIC MODEL · NOT A REAL ROAD
Road-traffic simulator
A seeded single-lane model with car-following and a fixed signal. The same seed and settings always give the same run. Its output is for test design and visualisation only.
Run the simulation to see vehicles on the road, the signal phase, and the queue over time.
BoundaryRaw inputs are not stored. Each run keeps its result (up to 128 KB), an input digest and the actor. Field-quality bands, maturity levels and gate decisions are aids for named owners. Nothing here is an audit, certification, compliance attestation or release approval.
OCDC GOVERNANCE · RISK · COMPLIANCE
AI and platform security controls
Record tenant-owned control reviews, risk treatment, and source references across AI, API, Kubernetes, identity, and recovery workflows.
Loading GRC workspace
Loading control and risk records…
Crosswalk boundaryNIST AI RMF, NIST CSF and OWASP references are OCDC review prompts. These records do not attest to organizational compliance, certify controls, or provide an immutable production audit store.
Control crosswalk
NIST AI RMF · NIST CSF 2.0 · OWASP LLM Top 10
Risk register
Inherent likelihood × impact, with named owner and treatment plan. To change a risk, see its history or import a file, open the risk register.
No tenant risk records.
Evidence references
OCDC stores provenance references and metadata, not underlying evidence content.
No evidence references recorded.
The current state backend is local JSON. This workflow does not provide legal advice, external framework attestation, certification, or protected production retention.