VSI GLOBAL // ENTERPRISE ARCHITECTURE

OSINT-061-real-time-situational-monitoring-collection

10 min read

[TOPIC/QUESTION] - Collection Map

OSINT-061 Real-Time Situational Monitoring - collection workspace. Central topic = the monitoring question / operational perimeter under watch. Branches = data-point categories that feed the standing watch criteria, tripwires, cadence, escalation, and SLA. Drop each collected value as a child node; expand it with where it was found and what it confirms. Paste raw tool/feed output into the node’s Notes. → feeds deliverable OSINT-061.

00 · Collection Plan - PIRs & EEIs

The intelligence requirements this service must answer on a continuous basis + the essential elements of information (EEI) that satisfy each. Tick as satisfied for the current reporting cycle; reset per cadence. → drives §1 Watch Criteria / Tripwires, §4 Escalation, §5 SLA, Annex A Source Register.

PIR-1 - Watch perimeter: is the operational perimeter fully defined and baselined?

  • EEI: monitoring area / geographic perimeter or event-stream scope documented and approved
  • EEI: seeding baseline product ingested (Country Risk Assessment or equivalent → §Scope)
  • EEI: all §1 watch items entered with tripwires and escalation routes assigned
  • EEI: all §2 collection lanes stood up and producing data

PIR-2 - Indicator / Warning: are active tripwires firing accurately?

  • EEI: each §1 watch item has at least one observable indicator confirmed collecting
  • EEI: tripwire thresholds calibrated to L×I risk score (per §4 key)
  • EEI: false-positive rate within §5 SLA quality bound
  • EEI: no watch item is silently dark (uncollected / feed failure)

PIR-3 - Escalation: do all severity tiers have a verified notification path?

  • EEI: Critical (L×I 21–25) notification path tested and acknowledged
  • EEI: High (L×I 16–20) notification path confirmed
  • EEI: Elevated and Moderate/Low paths confirmed
  • EEI: acknowledgement time targets agreed and logged in §5

PIR-4 - Source currency: are all standing sources active and graded?

  • EEI: every source / lane in §2 graded in Annex A (Admiralty A–F × 1–6)
  • EEI: last-verified date within required refresh cadence
  • EEI: degraded or dark sources flagged as gaps/RFIs

PIR-5 - Reporting cadence: are all periodic products delivered on time?

  • EEI: real-time alert product delivered within §5 SLA per tier
  • EEI: situational summary delivered on schedule
  • EEI: service-health report delivered on schedule

Collection gaps / RFIs (running)

  • [open collection gap] → route to [watch item / source lane]
  • [source dark / unverified] → regrade or replace
  • [tripwire uncalibrated] → pending threshold definition

00b · Monitoring Cadence & Triggers

Standing watch operations log. This branch is the operational heartbeat for the continuous service. → drives §2 Collection Cadence & Sources, §3 Reporting Cadence, §4 Escalation, §5 SLA.

Watch items - active list

Clone per §1 watch item row. Keep in sync with the deliverable’s §1 table.

  • [watch item # - e.g. W-01 Civil unrest / mass protest]
    • Observable indicator:
    • Tripwire threshold:
    • L×I score:
    • Severity tier: [Critical / High / Elevated / Moderate / Low]
    • Assigned collection lane (→ §2):
    • Escalation route (→ §4):
    • Status: [Active / Paused / Dark / Triggered]
    • Notes / last event:
  • [watch item # - e.g. W-02]

Refresh cadence schedule

  • Real-time / continuous lanes: [list lanes]
    • Feed health check: [e.g., every 15 min]
    • Feed failure alert: [e.g., after 30 min dark]
  • Hourly polling lanes: [list lanes]
  • Daily sweep lanes: [list lanes]
  • Event-triggered lanes: [list lanes]
    • Trigger condition:

Alert thresholds - calibration log

  • [threshold item - e.g. protest crowd size ≥ 500]
    • Rationale:
    • Calibrated on:
    • Next review:
    • Notes:
  • [threshold item 2]

Escalation path - verified contacts

  • Critical tier:
    • Notify:
    • Method:
    • Acknowledgement target:
    • Last tested:
  • High tier:
    • Notify:
    • Method:
    • Acknowledgement target:
  • Elevated tier:
    • Notify:
    • Method:
  • Moderate / Low tier:
    • Notify:
    • Method:

Service health - running metrics log

  • [metric period - e.g. 2026-W25]
    • Alerts fired:
    • False positives:
    • Summary deliveries on time:
    • Feed outages:
    • SLA breaches:
    • Notes:
  • [metric period 2]

01 · Drivers & Key Variables

The underlying conditions that define the baseline and move the risk picture. Changes here shift tripwire thresholds. → feeds §1 Watch Criteria (observable indicators column), §Scope (seeding baseline / Country Risk Assessment).

Baseline situational factors

  • [factor - e.g. political stability index of monitored area]
    • Current status / reading:
    • Source:
    • Confidence: [H/M/L]
    • Last updated:
    • Notes:
  • [factor 2]

Structural risk drivers

  • [driver - e.g. election cycle / leadership succession / economic stress]
    • Trajectory: [Stable / Deteriorating / Improving]
    • Relevance to watch items:
    • Source:
    • Notes:
  • [driver 2]

Client-specific exposure variables

  • [variable - e.g. client facility location / staff nationality mix]
    • Exposure type:
    • Watch items affected:
    • Notes:
  • [variable 2]

02 · Indicators & Warnings

The core of the monitoring service. Each indicator is a recurring clonable block tied to one or more §1 watch items. Clone per indicator type; add observations as children. → feeds §1 Watch Criteria / Tripwires (observable indicator + tripwire threshold columns), §4 Escalation.

Security / physical threat indicators

→ §1 Watch Criteria. Tools: RSS/atom aggregators, ACLED, OSM, armed-conflict trackers, local govt advisories.

  • [indicator - e.g. armed incident / attack report]
    • Watch item(s) served:
    • Tripwire threshold:
    • Observation (date + location + source):
    • L×I at time of observation:
    • Escalation fired?: [Yes / No / Pending]
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Notes / tool output:
  • [indicator 2 - e.g. civil unrest / protest activity]
    • Watch item(s) served:
    • Tripwire threshold:
    • Observation:
    • L×I at time of observation:
    • Escalation fired?:
    • Attribution confidence:
    • Notes / tool output:
  • [indicator 3]

Political / governance indicators

→ §1 Watch Criteria. Tools: parliament feeds, government announcement aggregators, party press-releases, diplomatic notices.

  • [indicator - e.g. emergency decree / martial law declaration]
    • Watch item(s) served:
    • Tripwire threshold:
    • Observation:
    • L×I at time of observation:
    • Escalation fired?:
    • Notes / tool output:
  • [indicator 2]

Economic / infrastructure indicators

→ §1 Watch Criteria. Tools: central bank feeds, fuel/commodity price trackers, power-outage maps, NOTAM/NOTAMR feeds.

  • [indicator - e.g. currency crisis / bank closure order]
    • Watch item(s) served:
    • Tripwire threshold:
    • Observation:
    • L×I at time of observation:
    • Escalation fired?:
    • Notes / tool output:
  • [indicator 2]

Public health / environmental indicators

→ §1 Watch Criteria. Tools: WHO disease outbreak news, GDACS, EMDAT, national health ministry feeds.

  • [indicator - e.g. disease outbreak declaration / WHO alert]
    • Watch item(s) served:
    • Tripwire threshold:
    • Observation:
    • L×I at time of observation:
    • Escalation fired?:
    • Notes / tool output:
  • [indicator 2]

Digital / cyber indicators

→ §1 Watch Criteria. Tools: Shodan alerts, social-media keyword monitors, paste-site monitors, dark-web alert subscriptions.

  • [indicator - e.g. targeted threat chatter mentioning client / facility]
    • Watch item(s) served:
    • Tripwire threshold:
    • Observation:
    • L×I at time of observation:
    • Escalation fired?:
    • Notes / tool output:
  • [indicator 2]

03 · Scenarios / Hypotheses

The plausible adverse scenarios the watch criteria are designed to detect early. Each scenario links to the indicators that would confirm or deny it. → feeds §1 Watch Criteria (tripwire threshold rationale), §4 Escalation (Critical / High tier trigger conditions).

Scenario block - clone per scenario

Scenario hypothesis + the indicator signature that would confirm it.

  • [scenario - e.g. rapid escalation from civil unrest to targeted violence against client assets]
    • Probability assessment: [High / Medium / Low]
    • Key confirming indicators:
    • Key denying indicators:
    • Tripwires linked (→ §1):
    • Escalation tier if confirmed: [Critical / High / Elevated]
    • Notes:
  • [scenario 2 - e.g. sudden border closure / evacuation trigger]
    • Probability assessment:
    • Key confirming indicators:
    • Key denying indicators:
    • Tripwires linked:
    • Escalation tier:
    • Notes:
  • [scenario 3]

Assumptions underpinning current watch posture

  • [assumption - e.g. client assets remain at fixed locations on file]
    • If violated: [effect on watch criteria]
    • Review trigger:
  • [assumption 2]

04 · Data Sources & Feeds

Every standing collection lane that populates §02 indicators. Clone per source. Grade with Admiralty scale (→ Annex A in deliverable). → feeds §2 Collection Cadence & Sources, Annex A Source & Watch-List Register.

Open / free sources

  • [source - e.g. ACLED conflict data / API]
    • Watch item(s) served:
    • Collection method:
    • Cadence: [real-time / hourly / daily / event-triggered]
    • Reliability (A–F):
    • Credibility (1–6):
    • Owner / collector:
    • Last verified / active:
    • Feed health status: [Green / Amber / Red / Dark]
    • Notes / tool output:
  • [source 2 - e.g. local government / official press-release feed]
    • Watch item(s) served:
    • Collection method:
    • Cadence:
    • Reliability (A–F):
    • Credibility (1–6):
    • Owner / collector:
    • Last verified / active:
    • Feed health status:
    • Notes / tool output:
  • [source 3]

Social / media monitoring lanes

Tools: keyword RSS/atom, TweetDeck/X search, Telegram channel monitors, local news aggregators.

  • [source - e.g. local-language Twitter / X keyword monitor]
    • Keywords / query:
    • Watch item(s) served:
    • Cadence:
    • Reliability (A–F):
    • Credibility (1–6):
    • Feed health status:
    • Notes / tool output:
  • [source 2]

Closed / subscription / human sources

  • [source - e.g. commercial risk data feed]
    • Watch item(s) served:
    • Cadence:
    • Reliability (A–F):
    • Credibility (1–6):
    • License / access basis:
    • Owner / collector:
    • Notes:
  • [source 2]

05 · Key Actors & Entities

Actors whose actions drive the monitored situation: governments, armed groups, civil-society organizations, key individuals. Clone per actor. → feeds §1 Watch Criteria (observable indicator - actor-linked events), §4 Escalation.

Actor block - clone per actor

  • [actor - e.g. ruling party / government security services]
    • Actor type: [State / Non-state armed group / Civil society / Economic / Other]
    • Relevance to watch items:
    • Recent significant actions:
    • OSINT footprint (official channels / social media):
    • Attribution confidence: [Confirmed / Probable / Possible]
    • Source(s):
    • Notes / tool output:
  • [actor 2 - e.g. opposition movement / protest organizer]
    • Actor type:
    • Relevance to watch items:
    • Recent significant actions:
    • OSINT footprint:
    • Attribution confidence:
    • Source(s):
    • Notes / tool output:
  • [actor 3]

Actor network map (adjacency)

  • [actor A] ↔ [actor B]: [relationship type - allied / opposed / covert link]
    • Basis:
    • Confidence: [H/M/L]

06 · Events Timeline

Running log of significant observed events that move the risk picture or fire (or approach) a tripwire. Clone per event. → feeds §3 Reporting Cadence (periodic situational summary content), §4 Escalation (trigger condition records), Annex A.

Event block - clone per event

  • [event date + brief label - e.g. 2026-06-15 · Mass protest, capital city]
    • Event type: [Security incident / Political development / Economic event / Environmental / Cyber / Other]
    • Location:
    • Watch item(s) affected:
    • Tripwire fired?: [Yes - tier: / No / Approaching threshold]
    • Source(s) + grade:
    • Summary:
    • Follow-up required:
    • Notes / evidence ref:
  • [event 2]
  • [event 3]

Trend observations (cross-event patterns)

  • [trend - e.g. protest frequency increasing week-on-week]
    • Evidence events:
    • Significance:
    • Watch items affected:
    • Notes:
  • [trend 2]

07 · Assumptions & Uncertainties

The working assumptions and known unknowns that bound the monitoring product’s reliability. → feeds §Scope Authorities & Limitations, §6 Review & Renewal, §5 SLA (false-positive / quality bound).

Explicit collection assumptions

  • [assumption - e.g. client will notify service of any change to facility locations or staff deployment]
    • If assumption violated:
    • Review mechanism:
  • [assumption 2 - e.g. open-source feeds remain accessible from collection environment]
    • If assumption violated:
    • Review mechanism:
  • [assumption 3]

Known collection gaps / blind spots

  • [gap - e.g. no local-language human source; reliant on translated secondary media]
    • Impact on watch items:
    • Mitigation:
    • Gap RFI ref:
  • [gap 2]

Uncertainty register

  • [uncertainty - e.g. government intention re: protest response - unknown]
    • Effect on tripwire calibration:
    • How would resolution change watch posture:
    • Review trigger:
  • [uncertainty 2]

99 · Collection Admin

Working register - not a deliverable section, but the audit trail and source accountability behind it. → feeds Annex A Source & Watch-List Register, Annex B Onboarding / Offboarding Checklist.

Source register

Every material datum traceable to a graded source. Admiralty A–F (reliability) × 1–6 (credibility).

  • [S-1 - source]
    • Type: [Primary / Secondary / Tertiary]
    • Reliability (A–F):
    • Credibility (1–6):
    • Date accessed:
    • Watch items served:
    • Notes:
  • [S-2]
  • [S-3]

Evidence archive

  • [EV-001 - screenshot / capture ref + hash + URL + timestamp]:
  • [EV-002]:

Alert / event log

  • [AL-001 - alert date/time · tier · watch item · notified · acknowledged]:
  • [AL-002]:

Onboarding / offboarding status

Tracks Annex B checklist items.

  • Authority / consent captured: [Yes / No / Pending]
  • Baseline ingest complete: [Yes / No / Pending]
  • Collection lanes stood up: [Yes / No / Partial]
  • Tripwires calibrated and active: [Yes / No / Partial]
  • Data retention schedule confirmed: [Yes / No / Pending]
  • Offboarding: [Not initiated / In progress / Complete]

Open gaps / verification pending

  • [gap item - feed dark / source unverified / threshold uncalibrated]
  • [gap item]

Periodic review log

  • [review date - e.g. 2026-Q3 formal review]
    • Reviewer:
    • Watch items changed:
    • Cadence changes:
    • SLA performance summary:
    • Next review date:

Graph View