CONNECTED INVESTIGATIONS
Your evidence. One working case.
Connect domain and CVE evidence, preserve sources and record your assessment.
Loading your workspace…
Keep your research private
Sign in to create a case and search your permitted evidence. No private data is stored in this browser.
Sign inBEGIN AN INVESTIGATION
Start with a domain or CVE. Follow the evidence.
Create a case or resume one from your list. Stored Guardian scans, retained threat observations and reviewed campaign matches appear together.
No active scanning, provider queries or inferred attribution.
CASE DETAILS
Investigation
Investigate a domain or CVE
Stored evidence onlyDomains and pasted URLs use the exact hostname; www remains separate. CVE-reference matches use permitted stored records. Missing results mean unknown. No target is visited.
SOURCE-LINKED EVIDENCE
Indexed connections
Public source evidenceCoverage and interpretation
Domain searches are bounded to 200 candidate saved scans and 200 candidate archived feed records. Workspace graph searches inspect up to 200 candidate connections and return up to 50 sourced edges. The combined evidence list holds up to 50 source records. Results are not a complete history. A URL host connection is structural, not a DNS observation. A campaign match is exact listed membership, not an attribution claim. CVE mentions and tool references do not establish exploitation or suitability. Arsenal references require a currently valid public cache.
Pinned evidence
Revalidated source referencesPins show currently permitted stored records, not frozen copies. Deleted scans and withdrawn campaign records become unavailable. Your own findings remain until you remove them. Save changes before exporting.