The portal is organized into two basic views, one for public interaction on the Internet, and another that is password protected for Subscribers.

Transcription

1 Help Pages - Threat Intelligence Portal Overview - The portal is a web-based means of supporting both the production and dissemination of Threat Intelligence. Powered by the improved TRITON database and drawing from extensive data feeds, the portal offers many new options to help customers meet their intelligence requirements. Google Maps are used as the centre-piece for the display, and working from the map or any of the associated features, users can adjust the display and view information in a variety of formats. The portal is organized into two basic views, one for public interaction on the Internet, and another that is password protected for Subscribers. INCIDENT MAP Viewable as a map or satellite image and can be zoomed in or out. Icon details are provided when clicked on. HOME This is the Public View of the Portal, available to all via any Internet connection. Those with subscriptions log-in from this page. INCIDENT COUNTER Refers to any deliberate act carried out for the purposes of terrorism, advancing a political agenda, or causing significant disruption to public order. Announcements and Links Timely bits of information on product releases, links to items of general interest. BREAKING NEWS Drawn from a web crawler that is optimized to display threat intelligence inputs. ANALYST NOTES Analysis of recent incidents provided by experts. Home/Public View This is the Home Page for the portal, accessible to casual browsers on the Internet and used by subscribers to log-in to the system. The Public View is meant to provide some useful information to our community of users and prospective users, while also providing a certain amount of guidance on how to learn more about the system. On the top right hand corner of the screen there are buttons to make subscription enquiries and for Subscribers to initiate the log-in process. Log-in / Data Access - The log-in process is quite standard, in that Subscribers fill out a form by clicking on the log-in link at the top right hand side of the home page, then enter the user name and password provided by Allen-Vanguard. Once the log-in is complete, Subscribers are taken to a view of Threat Intelligence that has been tailored to meet their specific needs. Subscriber Views All Subscribers have their organization name or some other designator showing on their page. For security or privacy reasons, not all organizations wish to be identified, and there are several alternative naming conventions available to accommodate such needs. The information provided to each Subscriber will be based on a standard subscription, a

2 customized intelligence requirement, or any combination of the two, as described below: Standard Subscription Products - These products are based on the TRITON series of intelligence reporting that covers terrorism and related incidents worldwide. Products are disseminated on a monthly cycle, augmented by Quick Look reports on incidents of particular magnitude and/or significance. Subscribers receive all TRITON reports and have access to all terrorism-related Incident records in the database in accordance with their chosen subscription level - Bronze, Silver, or Gold (click here). Customized Threat Intelligence Services - These services take advantage of the full range of Allen-Vanguard capabilities, allowing users to specify their intelligence requirements and receive a tailored product that meets their unique operational needs. An extensive variety of reporting and display features are available, priced on the level of effort required to meet individual customer requirements. An important adjunct of these services includes certain types of user-generated information that can be loaded and displayed in the portal on behalf of customers, further enhancing the context and relevance of the intelligence being provided (click here). EXPLANATION OF ICONS Icons reflect product offerings in standard subscription format or as customized intelligence. SUBSCRIBER VIEWS: Subscribers get much deeper and more operationally useful access to intelligence. SUBSCRIPTION LEVELS: Differentiated by depth of data made available to users. Available in Bronze, Silver & Gold. FOCUSED NEWS The news ticker can be customized to subscriber requirements. MY ARCHIVE Report archive is available for continuity purposes and ease of access. Screen Orientation - The screen is centred on a Google Maps display, with coloured icons used as the initial means of visualizing and querying intelligence reporting. In addition to manipulating the icons on the map, Subscribers also have access to a wide array of search, filter, zoom, chart/graph, and tabular display features that permit a very high level of flexibility to users in shaping their own views of the intelligence available. The map itself is surrounded by various boxes of textual information, allowing direct access to product archives, intelligence highlights, and dialog facilities to contact analysts. Finally, each screen is supported by a so-called news ticker that is regularly updated and fed by a purpose-built web crawler.

3 Map Display - Google Maps was chosen because of its widespread availability and ease of use. No real training is required. Most of the standard Google Maps features have been enabled in the portal, and Threat Intelligence data is overlaid on the map for viewing in a geo-spatial context. Key points with respect to the map are covered below. Features that interact with the map, located in the navigation bar on the top left of the map display, will be described elsewhere in the document. Controls - The standard Google Zoom In/Out features are enabled on the left side of the display. Users of tablets or those with a suitably equipped mouse can use alternative methods to Zoom. The normal default for the map display is the satellite imagery view, but different map backgrounds can be selected from the menu at the top right hand side of the map so that better contrast or greater detail can be obtained when needed. Database Records and Icons - There are six basic record types offered on the portal, along with one collective symbol used to describe multiple records in the same geographic location. The records are colour-coded to reflect different attributes, as described in the legend (click here). All records are marked as being for general viewing by TRITON Subscribers, or exclusive viewing by individual customers according to agreed specifications for customized intelligence reporting. By clicking on an icon, Subscribers can call up more information that appears in a dialog box. Default Settings Based on Subscription Levels Default settings apply mainly to TRITON Subscribers, as those with Customized Intelligence contracts can request their own default settings. For practical reasons, AV have imposed an initial default setting of 30 days on the number of TRITON records that can be displayed on the map to avoid excessive demand on the database. Bronze level Subscribers are limited to 30 days of data, whereas Silver and Gold Subscribers can go beyond the initial default settings to display several thousand records on the map within fixed limits. Beyond this, Silver and Gold Subscribers have the option of manipulating even larger amounts of data in the Charts, to include over 170,000 Incident recorders for Gold subscribers. To get beyond the initial AV default settings and interact with the data, users are directed to the filter page that has been provided.

4 Display Summary The Display Summary describes the number of records showing on the map. The red numbers on the top right of the map provide the total number of records returned, while the pop-up summary gives a more detailed breakdown of the records and a date range. The use of a pop-up to show details of the display allows users a degree of choice in deciding when to make it visible and where to locate it on the screen when doing presentations or screen captures. As indicated above, the initial AV default number of TRITON records showing on the map display at any one time is set at 30 days, with more records available depending upon subscription levels. As an example, if a Gold Subscriber entered a query that returned two years of Incident data, well over 20,000 records, the charts would show all of them, while only the first few thousand records would show on the map. If customers need more detailed map or chart views of the data that go beyond what is available in the portal, they can Contact the Analyst at Allen Vanguard to request this as a customized service. Positional accuracy - All AV Threat Intelligence is based upon open-source reporting, and every effort is made to enter the best possible geo-locating information into the database for each record. However, data is often drawn from news services or other sources that do not necessarily provide a high level of geographic precision. In many cases, statements like...security forces were attacked in the suburbs north of Baghdad can only be reflected on the map as estimated positions. Users should therefore be aware of potential inaccuracies in plotting of data. Unmapped Items Not all database records are suitable for displaying on the map, so a table has been reserved for users to see such items when they are returned by a query. See Other Features for an explanation.

5 Filter This feature allows Subscribers to determine what data will be displayed on the screen in accordance with their contracts, giving users extensive flexibility to manage their views of the intelligence available. The various boxes in the filter offer the user options based on time, location, record type, product and certain key words that might be used in the records. Selecting data and filling in boxes is done with simple mouse clicks and text entries, as applicable, and is meant to be as intuitive as possible. An Advanced Filter page is provided under the Locations tab so that users can filter by country or state/province. The results of each filtered query are shown in the Map Display, the Charts, and the Tables. While the instructions below provide some guidance, the easiest way to learn how the filter works is to try a few samples queries. Default Settings and Saving Filters Filters settings are controlled by the five buttons along the bottom of the window, described from right to left as follows: Submit Applies whatever inputs are set on the filter pages. Save My Filter Saves as default whatever inputs the user has set in the filter. Reload My Filter Reloads the user s saved filter settings. Reset Deletes any filters saved by users, restores original AV settings. Clear All Removes all inputs on the filter pages, including all default settings. Using the Filters An initial default setting is usually provided by AV, and can be accessed by clicking on the Reset button, then hitting Submit. The AV default could be, for example, display all records posted in the last 30 days. If users would prefer other default settings, they can change the input values on both filter pages to match the criteria they want/need. If users find a particularly appropriate setting that they would like to save as their default, they can do so by clicking on Save My Filter, then hitting Submit, which will override the AV default. In the mean time, and without overriding any default settings, users can enter any number of short-term queries and display results by hitting Submit. Any time the user wishes to reset the filter completely, they have the option of Reloading their own default filter setting, Resetting the AV default filter, or Clearing All filters to start fresh.

6 Example 1 Entering a Basic Query: In the example below, the user is a Gold level Subscriber who wishes to see all the incidents in Africa over a one year period in which an Improvised Explosive Device (IED) was involved. Africa is selected from the Region box, the dates are adjusted to cover one year, the Incident record type is selected, and IED is entered into the acronym box. When the user hits Submit, the map zooms in on Africa and displays the appropriate number of incidents. The number of incidents returned is shown in the Display Summary, the charts, and the tabular view of results.

7 Example 2 Filtering Different Products: In this example, the user has a custom intelligence subscription allowing access to both TRITON and a US-based product called Edu-Watch. The user wishes to know the number of Threat records that have been entered under the Edu-Watch product line since the start of Once the inputs are selected and the filter is submitted, the screen is automatically zoomed in on the area of interest for Edu-Watch, which is the USA. Filtering by Product - Custom Intelligence View Filtering by Product - Custom Intelligence View

8 Example 3 Using the Advanced Filter: Building on the previous example, the user clicks on the word Advanced on the first page of the filter, spawning the page below. From this page, a user can refine a filter by country or by state/province. In this example, the user refines the previously set filter by focusing on Threat records in just two US states, New York and Alabama. Once the selection is made, the user hits the Apply/Back button and then Submits from the main filter page. The resulting page shows only the requested information in the two states. Example of an Advanced Query, State/Province Level

9 Charts - The default chart feature is based on the historical records of Incidents in the TRITON database. As there are over 170,000 Incidents recorded, Subscribers have the option of sorting through and viewing data as far back as their subscriptions allow. The various charts are based on those used in the standard TRITON monthly reports, but in this format the amount of data and the parameters of the filter can be adjusted to suit the needs of the user. The Chart Feature The collage above shows a cascading series of pages related to the Chart features. Charts are accessed on the navigation bar at the top left of the map display. When the Chart page initially appears, the total number of Incident records is shown on the top left of the Chart display, with a drop-down box showing on the top right of the window. The drop down window offers a number of choices for displaying different aspects of the Incident records in various formats. Charts are selected using a tick-box and then by hitting Apply. The first example shows a bar chart reflecting incidents organized by date. The second example is a pie chart showing a breakout by country. As was the case with filters, the best way to understand the Chart features is to try them out.

10 Filtered Results in Charts The Charts merely reflect the settings in the Filter Feature, and so changes to the content of the Charts must be done through the Filters. Each time a Filter is applied, the Charts change to reflect the results, focusing only on Incident records. Note that both mapped and unmapped incidents will be captured in the Charts, and totals in the charts will often exceed the limited number of Incidents that can be displayed, as illustrated in the example below. In the example, a Filter was set to show two years of Incident records. The limits on the map would only allow 2,500 Incident records to be mapped. However, the full number of records requested can be seen in the selected chart, a total of 29,628 records. While it would be considered far too impractical for anyone to interrogate such a large number of records through the map interface, the Chart provides the sort of aggregation needed for larger record volumes. When a customer wishes to drill down on a more limited time period, the map and tabular views can then come back into use for the more detailed levels of data interrogation required. Refreshing the Charts In some cases, queries will not be reflected in the Charts at all, as they may focus on Reports or Threat records that are not used in the Charts. Users will note that results from earlier query/filter activity may still be showing in the Charts long after the original query. The next time a query is done involving Incidents, the old results will be over-written and the new results will become apparent when the Apply button is used to refresh the screen. Default Settings in Charts Default settings apply primarily to TRITON Subscribers, as those with Customized Intelligence contracts are usually provided with their own unique default settings. The TRITON default limits for Charts are based on subscription levels, with Bronze Subscribers seeing the most recent 30 days of Incident records, Silver Subscribers seeing the current year, and Gold Subscribers being able to manipulate all the Incident records in the database. Within the confines of a user s subscription, defaults can be re-set according to user requirements in the filter feature using the Save My Filter button. Customization of Charts and Graphs Given that the Charts are based on the TRITON model, it is recognized that some of the charts may not apply to users of Customized intelligence reporting. A certain amount of customization can be attained by selecting only the Charts that are relevant to a user s requirements and ignoring those that are not relevant. For example, users with a focus on the US may not be interested in graphs that show all the regions and countries of the world, and can therefore leave these particular graphs to one side when sifting through the data. Beyond these temporary customization measures, users can request unique Charts that can be inserted into the Chart display format. This individual customization of charts and graphs is considered an additional service that can be arranged based on specific user requirements.

11 Other Features There are several other features worthy of note: Tabular Results Some users prefer to see query results returned in the form of a table, as shown under the word Table in the navigation bar above the map display. The standard table shows individual pages for Incidents, Threats, and Reports, along with a counter. Note that the counter captures both mapped and un-mapped database records. Filtered results are also accessible in tabular format. Un-mapped Items - While most database entries will have a geospatial component that will allow them to be displayed on a map, there are some exceptions. Depending on their subject matter, reports of a summary nature or with a broad geographic scope do not always lend themselves to being displayed as a single dot on a map. When the default query or a filtered query calls up such records, they are displayed in a tabular format similar to that shown above. Pop-up Map This feature is designed to provide a clean view of a Map Display without a lot of other distracting information from the surrounding web page. It provides a larger image, and

12 the display can be fine-tuned using the filter and map controls. To offer a few examples, this sort of view is useful in an operations centre, on a large screen TV, or for presentations. A screen capture of the pop-up map can also be ingested into a slide show. Note that when the Pop-up Map is selected, the display automatically defaults to the satellite imagery background, but of course this can easily be changed using the controls on the top right of the map. Pop-up map feature increases available screen space & allows for customization of view. Future Enhancements - As shown in the legend, there are other record types such as Events, Asset Tracking, and My Intel that are envisioned as enhancements based on customer demand. Other record types and icons may be added over time. Improved Situational Awareness The combination of reporting options and display features encourages user interaction with the intelligence Customization - The more that customers elect to make use of the various customized reporting features on offer, the more fulsome and complete will be their situational awareness. The fact

13 that customers can geo-spatially display their own positional information and intelligence reporting in conjunction with many other types of information that are important to individual users is considered a major advantage of the Threat Intelligence Portal. It is recommended that customers meet with an Allen Vanguard representative to assess intelligence requirements and go through a review of intelligence support options that might best serve these needs. Misc To be promulgated.

14 My Archive - This feature provides a searchable catalogue of all reports that have been purchased by a Subscriber. The contents of the archive are based on the length of time a Subscriber has been a customer, and therefore are not related to the subscription level reflected in the Map Display. For example, a customer may have a Bronze level TRITON subscription that permits access to 30 days worth of records to be seen and manipulated/filtered on the map, in the charts, and in the table. But if this same customer has been a Subscriber for two years, all reports issued to that customer over a two year period would be visible in the archive. Default Settings The default setting shows the 10 most recent reports that have been issued to the Subscriber. Searching the Archive Using the search boxes at the top of the archive, users can go through the archive and call up particular items as needed. Selecting a date range is intuitive, just as it is in the Filter. The text and numerical fields are searched with logical terms such as Contains, Starts With, and Equal To. Custom Reports - Custom Intelligence Reports can also be seen and queried in the Archive, with distribution restricted to the particular customer. Note Just to re-confirm, the My Archive feature is a stand-alone module within the portal. It is not influenced by the Filter, nor is it linked in any way to the map display. The sole purpose of the Archive is to provide a convenient repository for long-term access to Reports that have been purchased by a given organization, providing a means of continuity as staff turns over. As a customized intelligence service, other reference documents provided by the user can be stored in the archive as well.

15 Links Frequently Asked Questions Subscription Help Contact the Analyst See box on bottom right of subscriber view.