Detection Operations Cockpit
ATT&CK / Kill Chain orientation, source-backed rows, controlled validation, proof ceilings, and Hoxline claim control in one routed machine.
detection source packages, ATT&CK orientation, event-field contracts
hawkinsoperations-detectionsreviewer orientation; not live coverage proof
detections metadata49 controlled validation fires / 106 validation cases
hawkinsoperations-validationproof records and claim ceilings where present
hawkinsoperations-proofunsupported runtime/signal/public-safe wording blocked or downgraded
Hoxline / Claim Firewallpublic navigation only
hawkinsoperations-websiteDetection artifact to public wording
The route starts in detection source and only becomes public wording after validation, proof ceiling, Hoxline claim control, and website rendering boundaries are respected.
ATT&CK / Kill Chain operations board
T1059.001 · Command and Scripting Interpreter: PowerShell
Persistence: service creation — ATT&CK mapping in source artifact
Scheduled Task/Job: Scheduled Task — ATT&CK mapping in source artifact
Cloud / IAM denial — mapping in source/proof artifacts
ATT&CK-aligned identity behavior (mapping per detection)
Defense evasion / telemetry tamper — mapping in source artifact
Boundary / corroboration contract — not a coverage claim
Pipeline route contract — not an ATT&CK detection proof
Kill Chain navigator
Use this stage to inspect visibility planning, identity-context validation, and gap tracking without inferring live coverage.
Detection Inventory Cockpit
ATT&CK and Cyber Kill Chain mapping help reviewers navigate detection intent. They do not prove live telemetry, runtime deployment, signal observation, or customer use.
T1059.001 · Command and Scripting Interpreter: PowerShell
Persistence: service creation — ATT&CK mapping in source artifact
Scheduled Task/Job: Scheduled Task — ATT&CK mapping in source artifact
Cloud / IAM denial — mapping in source/proof artifacts
ATT&CK-aligned identity behavior (mapping per detection)
Defense evasion / telemetry tamper — mapping in source artifact
Boundary / corroboration contract — not a coverage claim
Pipeline route contract — not an ATT&CK detection proof
Authority boundary
Detection cards show source, validation, mapping, and proof-boundary status. They do not create deployment, signal, or public proof.
Source truth into claim control
Detection source and controlled validation can feed the Hoxline loop, but the runtime and signal gates remain separate until evidence exists.
stage_status_distribution
Capability Visual Data Pack v1 exposes the loop as status data, not as a flat warning list.
build_timeline
Tap a node to inspect what exists today and what remains gated.
manifest
Controlled demo artifacts and reviewer entry points were packaged.
Flagship controlled-validation example
T1059.001 · Command and Scripting Interpreter: PowerShell
Validation
Proof ceiling
Source -> validation -> proof ceiling
Each card keeps source, validation, proof ceiling, and runtime/signal boundary visible so detection work cannot be over-promoted.
Endpoint / PowerShell
T1059.001 · Command and Scripting Interpreter: PowerShell
Endpoint / Persistence
Persistence: service creation — ATT&CK mapping in source artifact
Endpoint / Persistence
Scheduled Task/Job: Scheduled Task — ATT&CK mapping in source artifact
Cloud / IAM
Cloud / IAM denial — mapping in source/proof artifacts
Identity / Access Behavior
ATT&CK-aligned identity behavior (mapping per detection)
Telemetry / Defense Evasion
Defense evasion / telemetry tamper — mapping in source artifact
Network / Visibility Contract
Boundary / corroboration contract — not a coverage claim
Pipeline / Telemetry Contract
Pipeline route contract — not an ATT&CK detection proof
Claim boundary
Mapping
Cyber Kill Chain and ATT&CK mapping help reviewers understand lifecycle stage, detection intent, and coverage. They do not prove live telemetry, runtime deployment, signal observation, or customer use.
Reconnaissance
Use this stage to inspect visibility planning, identity-context validation, and gap tracking without inferring live coverage.
Strongest reviewer artifact: ID-DET validation reports and HO-NDR-001 / HO-PIPE-001 boundary contracts.
Weaponization
Use this stage to see how behaviors become testable detection artifacts and where proof records do or do not exist.
Strongest reviewer artifact: Proof records for HO-DET-001, HO-DET-011, HO-DET-012, and AWS-DET-001 where present.
Delivery
Use this stage for cloud-access fixture review only; it does not assert a live AWS deployment.
Strongest reviewer artifact: AWS-DET-001 proof record and proof card.
Exploitation
Use this stage to trace PowerShell execution detection from ATT&CK mapping through source, validation, and proof boundary.
Strongest reviewer artifact: HO-DET-001 proof record, proof card, Proof Pack 001, and validation report.
Routes
