Interactive Case Study · Active Lab

DH7 Intel Operations Dashboard

A production-style intelligence dashboard that fuses world events, cyber intelligence, CSP incidents, market signals, disaster overlays, and vulnerability data into a single operator view. This case study captures shipped architecture, current analyst workflows, and the next delivery targets.

Theater View

Atlantic-centered map ops

Data Backbone

Supabase schema + retention model

Analyst UX

Signal rails, ticker, status strip, chat

Reliability

Provider health + fallback paths

Dashboard preview

Recent production capture from the live Intel dashboard, showing map operations, stream health, market telemetry, and Security Watch context.

Open video in new tab

Aggregation Architecture

Core flow from external OSINT-style feeds through ingestion and normalization into map overlays, feed rails, and operator actions.

Open Source FeedsGeo, cyber, infra, economicProvider Status InputsHealth + freshness metadataIngest + Normalize LayerSchema map, severity, region tagsSupabase Schemaevents, risk_snapshots, statusMap + Overlay LayerAtlantic view + CSP footprintSignal Rails + FeedSecurity watch + event streamContextual Analyst ChatState-aware interaction layer

Provider and API coverage

Current production signal coverage spans public intelligence, cloud/provider status, market/crypto telemetry, vulnerability intelligence, disaster overlays, and platform-health context. Provider health is tracked independently so degraded upstreams remain visible to operators.

World events and open-source intel

  • - Hacker News API (`hn.algolia.com`)
  • - GDELT Doc API (`api.gdeltproject.org`)
  • - Selected RSS fallback sources for redundancy

Cloud service and platform status

  • - AWS status (`status.aws.amazon.com/data.json`)
  • - GCP incidents (`status.cloud.google.com/incidents.json`)
  • - Azure status feed (`azure.status.microsoft` RSS)
  • - GitHub, npm, and Vercel Statuspage APIs

Markets and digital assets

  • - Alpaca market data
  • - Yahoo chart/quote feed
  • - CoinGecko markets API
  • - Kraken public ticker API

Aviation and flight telemetry

  • - OpenSky Network states API (`opensky-network.org/api/states/all`)
  • - Live `flight_activity` map overlay with near-real-time polling
  • - Overlay-linked event normalization via `air_opensky` source mapping

Cyber threat and security watch feeds

  • - CISA advisories + CISA KEV catalog
  • - URLhaus, Feodo Tracker, MalwareBazaar
  • - Ransomware.live + Tor exit-node list
  • - GreyNoise community API (optional key)

Vulnerabilities and exploit probability

  • - NVD CVE 2.0 API
  • - FIRST EPSS API
  • - Secondary enrichment from GitHub Advisory DB + OSV.dev

Geospatial hazard overlays

  • - USGS global earthquake GeoJSON feed
  • - NASA EONET open-events API (wildfire/storm/volcanic)

Current implementation focus

  • - Concurrent ingestion across world, cyber, CSP, market, crypto, geo, and vulnerability source families.
  • - Normalized writes to `event_sources`, `events`, `data_stream_status`, and `risk_snapshots` backing feed, alerts, and map APIs.
  • - Live flight telemetry is active through OpenSky integration and rendered as a dedicated `flight_activity` overlay.
  • - Security Watch expanded with URLhaus, CISA advisories, Feodo, MalwareBazaar, ransomware, Tor, and optional GreyNoise signals.
  • - Contextual operations chat is integrated with dashboard state and produces shareable analyst artifacts for briefing workflows.

How data is interpreted

  • - Severity scoring is rule-based per domain (incident text, percent-change thresholds, CVSS/EPSS, and source context).
  • - CSP incidents are region-resolved into map coordinates via token matching for infrastructure overlay visibility.
  • - Source health is tracked independently (`ok`, `degraded`, `error`) so stale-provider risk is explicit to operators.
  • - Retention policy is defined as 30/90/365-day tiers (hot events, vuln context, and aggregate trend history).

Delivered since initial release

Feed expansion

Expanded source coverage across cyber intelligence, CSP/platform health, vulnerability advisories, and market/crypto feeds.

Operational resilience

Hardened provider-level status handling with explicit degraded/error states and fallback paths for upstream instability.

Contextual chat + artifacts

Extended analyst workflows with context-aware chat actions and artifact outputs designed for fast operator handoff.

Production-facing demo cadence

Maintained a continuously deployed public environment with active telemetry and rapid iteration across map, feed, and briefing surfaces.

Next implementation targets

Runbook automation

Add threshold-based escalation hooks, guided triage prompts, and role-aware runbook routing.

Correlation and narrative stitching

Group related multi-source signals into incident narratives with explicit confidence/provenance tracking.

Persistence depth

Add dedicated quote, incident, and IOC storage models for replay, auditing, and retrospective analysis.

Scheduled orchestration hardening

Expand automated ingestion/snapshot/retention jobs with stronger observability and recovery controls.

Public webcam overlays + dashboard component

Add geospatially pinned public webcams to the map and expose a dedicated dashboard component for live visual context in operator workflows.

Live demo

The active dashboard is available at labs.dh7systems.com and is iterating in public as ingestion and analyst features expand.

Open Intel Dashboard
Back to portfolio