Indicators and warning

A notice is a prompt to think, not a conclusion.

Indicator conditions that raise notices and create follow-on collection work.

How it works

Analysts define indicator conditions against retained evidence. When a condition is met, subscribers receive a notice through Pulse, triage it, and either record it as addressed or raise follow-on requirements and collection tasks in Direction.

Boundaries

Subscriptions are bounded by existing permissions and grant no access to unrelated records. An unmet or expired condition is an actionable state, not a silent pass.

Indicators and warning

Element

Analyse

Versioning

Condition revision

Human decision

Triage decision

Status

Implemented

Related capabilities