OSINT-062-crisis-monitoring-dashboard-common-operating-picture-collection

[CRISIS / MONITORED SITUATION] - Collection Map

OSINT-062 Crisis Monitoring Dashboard / Common Operating Picture - collection workspace. Central topic = the crisis event, threat environment, or monitored situation populating the dashboard. Branches = the data-point categories that feed the live COP, indicator watches, and escalation feed. Drop each collected value as a child node; expand it with source, timestamp, and what alert tier (if any) it triggered. Paste raw tool output or feed extracts into the node’s Notes. Ingest baseline from OSINT-061-real-time-situational-monitoring before standing up lanes. Downstream output feeds OSINT-063-post-crisis-after-action-report.

00 · Collection Plan - PIRs & EEIs

The standing intelligence requirements and essential elements of information (EEI) this dashboard must keep current across the crisis lifecycle. Tick when satisfied per reporting cycle; re-open each cycle. Maps to the deliverable’s core dashboard purpose: real-time situational awareness, COP maintenance, indicator tracking, and escalation support.

PIR-1 - Situation Status: What is the current operational status of the crisis and its geographic / functional scope?

• EEI: crisis type confirmed (natural disaster / security incident / civil unrest / health emergency / cyber / infrastructure / compound)
• EEI: current phase confirmed (pre-crisis / active / escalating / stabilising / recovery)
• EEI: geographic scope and affected areas updated in current cycle
• EEI: population / personnel at risk confirmed and current
• EEI: key infrastructure or asset status confirmed (operational / degraded / offline)

PIR-2 - Indicators & Warnings: Are there signals of escalation, expansion, or phase transition?

• EEI: active tripwires from indicator register reviewed against current observations
• EEI: new indicators not in current register identified and added
• EEI: disconfirming signals assessed (situation de-escalating / scope contracting)
• EEI: phase-transition threshold - has any crossed?

PIR-3 - Key Actors: What are principal actors doing, and do their actions change the situation trajectory?

• EEI: government / authority posture and declared response posture current
• EEI: threat actor or adverse party actions current (if security crisis)
• EEI: humanitarian / NGO / international body engagement current
• EEI: swing actor or spoiler movements identified

PIR-4 - Client / Principal Exposure: Are protected persons, assets, or interests directly affected or at risk?

• EEI: client personnel in affected area confirmed and current
• EEI: client assets or facilities in affected area confirmed and current
• EEI: safe-to-operate or suspend-operations threshold crossed?
• EEI: communication with client personnel confirmed

PIR-5 - Source Health & COP Integrity: Are all collection feeds live and the COP accurate?

• EEI: all §4 source lanes returned data within scheduled cadence
• EEI: no source degradation, access failure, or information blackout outstanding
• EEI: COP last updated and marked with timestamp
• EEI: previous-cycle gaps or stale layers flagged for refresh

Collection gaps / RFIs (running)

• [open gap - lane or area not covered] → route to [source / analyst / OSINT-061-real-time-situational-monitoring]
• [open gap - actor intent not confirmed] → escalate to client or specialist
• [stale data layer - last updated >threshold] → refresh action:

00b · Monitoring Cadence & Triggers

OSINT-062 is a continuous system deliverable (type: system). This branch governs the dashboard watch schedule, lane refresh cadence, alert thresholds, and escalation path during an active crisis monitoring engagement.

Active watch items (COP layer)

Seed one block per active watch item. Clone per item.

• [watch item - e.g. reports of armed clashes approaching client facility]
  • Observable indicator:
  • Tripwire threshold (what triggers an alert):
  • Likelihood (1–5):
  • Impact (1–5):
  • L×I score:
  • Severity tier: [Critical 21–25 / High 16–20 / Elevated 11–15 / Moderate-Low 1–10]
  • Escalation route: [Tier 1 - immediate / Tier 2 - urgent / Tier 3 - routine]
  • COP layer:
  • Status this cycle: [Open / Fired / Clear / Monitoring]
  • Notes / tool output:
• [watch item - e.g. declared state of emergency in affected region]
  • Observable indicator:
  • Tripwire threshold:
  • Likelihood:
  • Impact:
  • L×I score:
  • Severity tier:
  • Escalation route:
  • COP layer:
  • Status:
  • Notes / tool output:
• [watch item - e.g. disruption to critical infrastructure (power/comms/transport)]
  • Observable indicator:
  • Tripwire threshold:
  • Likelihood:
  • Impact:
  • L×I score:
  • Severity tier:
  • Escalation route:
  • COP layer:
  • Status:
  • Notes / tool output:

Collection-lane refresh cadence

Map each §4 source lane to its scheduled check frequency and last-run timestamp.

• [lane - e.g. wire services / newswire monitor]
  • Cadence: [continuous / hourly / every-4h / daily]
  • Last run:
  • Next scheduled:
  • Source grade (Admiralty):
  • Notes / health:
• [lane - e.g. social media geolocation / OSINT sentinel]
  • Cadence:
  • Last run:
  • Next scheduled:
  • Source grade:
  • Notes / health:
• [lane - e.g. official government / emergency authority feeds]
  • Cadence:
  • Last run:
  • Next scheduled:
  • Source grade:
  • Notes / health:
• [lane - e.g. conflict event database (ACLED / UCDP)]
  • Cadence:
  • Last run:
  • Next scheduled:
  • Source grade:
  • Notes / health:

Alert thresholds and escalation path

• Tier 1 - Immediate (Critical): [threshold definition] → Action: [notify client + analyst on-call within X mins]
• Tier 2 - Urgent (High): [threshold definition] → Action: [push alert + COP update within X hours]
• Tier 3 - Routine (Elevated / Moderate): [threshold definition] → Action: [include in next scheduled report]
• Escalation path:
  • Primary contact:
  • Secondary contact:
  • On-call analyst:
  • After-hours escalation:
• Alert channel(s): [email / Signal / SMS / secure portal / voice]
• COP refresh frequency: [continuous / hourly / every-4h / daily]
• Crisis-phase override cadence: [active-crisis: continuous / stabilising: hourly / recovery: daily]

Cycle closure and handover

• Reporting cycle: [24h / 12h / 6h / event-driven]
• Cycle report format: [COP snapshot / flash alert / sitrep / full update]
• Downstream handover to: OSINT-063-post-crisis-after-action-report (on crisis resolution)
• Re-escalation trigger (from recovery back to active monitoring):

01 · Drivers & Key Variables

The forces whose movement most determines the trajectory and duration of the crisis and the severity of impact on the client. Each variable is assessed on current reading, direction of travel, and indicator set. Maps to the COP situation-status and threat-level layers.

Variable / Driver register

Clone one block per variable. Assess each on current reading and direction of travel.

• [variable - e.g. Security conditions / armed-actor dynamics]
  • Current reading (H/M/L stress):
  • Direction of travel: [Deteriorating / Stable / Improving]
  • Key indicator(s) to watch:
  • Threshold (what change would shift severity tier):
  • Source(s) / grade:
  • Confidence in reading: [H/M/L]
  • Notes / tool output: ← ACLED, UCDP, Jane’s, IISS, Liveuamap, conflict trackers
• [variable - e.g. Government / authority response capacity]
  • Current reading:
  • Direction of travel:
  • Key indicator(s):
  • Threshold:
  • Source(s) / grade:
  • Confidence:
  • Notes / tool output:
• [variable - e.g. Infrastructure / utility status (power, comms, transport)]
  • Current reading:
  • Direction of travel:
  • Key indicator(s):
  • Threshold:
  • Source(s) / grade:
  • Confidence:
  • Notes / tool output: ← GDACS, OCHA, infrastructure monitoring feeds
• [variable - e.g. Humanitarian conditions / displacement]
  • Current reading:
  • Direction of travel:
  • Key indicator(s):
  • Threshold:
  • Source(s) / grade:
  • Confidence:
  • Notes / tool output: ← UNHCR, OCHA ReliefWeb, IOM
• [variable - e.g. Information environment (contested / deception signals)]
  • Current reading:
  • Direction of travel:
  • Key indicator(s):
  • Threshold:
  • Source(s) / grade:
  • Confidence:
  • Notes / tool output: ← DFRLab, EEAS DisinfoLab, social-listening tools

Dominant / linchpin variable identification

• Dominant driver (most determines situation trajectory):
• Threshold variable (whose crossing changes COP tier):
• Current overall situation assessment: [Acute / Serious / Elevated / Contained / Residual]

02 · Indicators & Warnings

Observable signals that movement is occurring toward escalation, phase transition, or impact on the client. Each indicator is assessed for status, severity, and consistency with the active scenario. Maps to the COP alert layer and the tripwire register in §00b.

Warning indicator register

Clone one block per indicator. Maintain status in real time during active monitoring.

• [indicator - e.g. armed group movement toward client facility perimeter]
  • Observable via: [satellite imagery / social media geolocation / SIGACT report / eyewitness / media / official]
  • Scenario it tests: [Escalation / Stabilisation / Containment / Relapse]
  • Severity if triggered: [Critical / High / Elevated / Moderate / Low]
  • Current status: [Not present / Emerging / Present / Confirmed]
  • Alert tier triggered: [Tier 1 / Tier 2 / Tier 3 / None]
  • Recommended action: [Watch / Alert client / Escalate / Re-assess / Notify AAR feed]
  • Source grade: [A–F / 1–6]
  • Timestamp last assessed:
  • Notes / tool output: ← Planet Labs / Maxar / Sentinel Hub, Liveuamap
• [indicator - e.g. loss of communications with client personnel]
  • Observable via:
  • Scenario:
  • Severity:
  • Status:
  • Alert tier:
  • Action:
  • Source grade:
  • Timestamp:
  • Notes / tool output:
• [indicator - e.g. disruption to civil aviation or ground transport corridors]
  • Observable via:
  • Scenario:
  • Severity:
  • Status:
  • Alert tier:
  • Action:
  • Source grade:
  • Timestamp:
  • Notes / tool output: ← FlightAware, FlightRadar24, NOTAM feeds, AIS Marine Traffic
• [indicator - e.g. declaration of curfew / martial law / state of emergency]
  • Observable via:
  • Scenario:
  • Severity:
  • Status:
  • Alert tier:
  • Action:
  • Source grade:
  • Timestamp:
  • Notes / tool output:
• [indicator - e.g. significant casualty report in affected area]
  • Observable via:
  • Scenario:
  • Severity:
  • Status:
  • Alert tier:
  • Action:
  • Source grade:
  • Timestamp:
  • Notes / tool output:

Disconfirming / de-escalation indicators

Signals that the situation is stabilising or scope is contracting.

• [indicator - e.g. ceasefire declaration by principal parties]
  • Observable via:
  • Confidence:
  • Status:
  • COP adjustment triggered: [Yes - downgrade tier / No - wait for confirmation]
  • Notes / tool output:
• [indicator - e.g. resumption of civil aviation / transport corridors]
  • Observable via:
  • Status:
  • Notes / tool output:

03 · Scenarios / Hypotheses

The competing situation trajectories being tracked by the dashboard. H1 = current assessment (most likely trajectory); H2 = principal alternative; H3 = most dangerous alternative. Maps to the COP scenario-layer and underpins escalation thresholds in §00b.

H1 - Current / Most Likely Trajectory

• Description:
• Likelihood term (ICD 203):
• Analytic confidence: [HIGH / MODERATE / LOW]
• Principal drivers supporting it:
• Most diagnostic evidence (current cycle):
• Key uncertainties:
• What would overturn it (switch to H2 or H3):
• COP tier implied:
• Notes:

H2 - Principal Alternative Trajectory

• Description:
• Likelihood term (ICD 203):
• Analytic confidence:
• Trigger conditions (what causes pivot from H1):
• Watch indicators (signals H2 is emerging):
• COP tier implied:
• Notes:

H3 - Most Dangerous Trajectory

• Description:
• Likelihood term (ICD 203):
• Analytic confidence:
• Trigger conditions:
• Watch indicators:
• COP tier implied:
• Client impact if realised:
• Notes:

Scenario comparison / COP notes

• Currently assessed trajectory: [H1 / H2 / H3]
• Most diagnostic discriminating evidence this cycle:
• Last scenario reassessment:
• Next scheduled reassessment:

04 · Data Sources & Feeds

Every source and feed used to populate the COP and maintain the indicator register. Each source is assessed for reliability, cadence, coverage, and self-interest risk. Maps to the collection-lane register in §00b and the §99 source register.

Source / feed register (cloneable)

Clone one block per material source or feed. Apply Admiralty two-axis grade.

• [source - e.g. Reuters / AP / AFP wire]
  • Type: [Newswire / Official / NGO / Commercial dataset / Social media / Satellite / In-country contact / Government]
  • Reliability grade (A–F):
  • Credibility grade (1–6):
  • Self-interest / bias caveat:
  • Coverage scope (geographic / thematic):
  • Cadence / refresh:
  • Last accessed:
  • Feed URL / access method:
  • Notes / tool output: ← Reuters Connect, AP Newsroom, AFP Forum
• [source - e.g. ACLED conflict data]
  • Type: [Commercial conflict-events dataset]
  • Reliability grade:
  • Credibility grade:
  • Self-interest caveat:
  • Coverage scope:
  • Cadence:
  • Last accessed:
  • Notes / tool output: ← ACLED, UCDP, GDELT
• [source - e.g. OCHA / UN humanitarian feeds]
  • Type: [Multilateral / Humanitarian official]
  • Reliability grade:
  • Credibility grade:
  • Self-interest caveat:
  • Coverage scope:
  • Cadence:
  • Last accessed:
  • Notes / tool output: ← OCHA ReliefWeb, HDX, UNHCR Operational Data
• [source - e.g. host-government / national emergency authority]
  • Type: [Official government]
  • Reliability grade:
  • Credibility grade:
  • Self-interest caveat: [Potentially self-interested; corroborate against independent]
  • Coverage scope:
  • Cadence:
  • Last accessed:
  • Notes / tool output:
• [source - e.g. social media geolocation / open-source sentinel]
  • Type: [Social media / OSINT aggregator]
  • Reliability grade:
  • Credibility grade:
  • Self-interest caveat:
  • Coverage scope:
  • Cadence:
  • Last accessed:
  • Notes / tool output: ← TweetDeck / TweetHunter saved searches, Bellingcat tools, Maltego, InVID

Baseline products consumed

• OSINT-061-real-time-situational-monitoring - how incorporated:
• Situation baseline product / country study - how incorporated:

COP tools / platform

• Mapping / GIS platform in use: ← Google Earth Pro, QGIS, ArcGIS, Palantir, Google Maps
• Dashboard / COP platform:
• Alert distribution channel:
• Collaboration / sharing tool:

05 · Key Actors & Entities

The actors whose decisions or actions most shape the current situation trajectory and the client’s exposure. Clone one block per actor. Assess interest, capability, and current trajectory. Maps to the COP actor layer and underpins PIR-3 and scenario assessment in §03.

Key actor register

Clone per actor. Include response authorities, threat actors, humanitarian actors, international bodies, and client-side contacts.

• [actor - e.g. National government / crisis management authority]
  • Role / function:
  • Interest relative to situation:
  • Capability to shape outcome: [High / Medium / Low]
  • Current posture / recent signals:
  • Relationship to other actors:
  • Source basis:
  • Attribution confidence: [Confirmed / Probable / Possible]
  • Notes / tool output:
• [actor - e.g. Armed group / threat actor (if security crisis)]
  • Role / function:
  • Interest:
  • Capability:
  • Current posture / trajectory:
  • Area of operation / proximity to client assets:
  • Source basis:
  • Attribution confidence:
  • Notes / tool output: ← Jane’s, IISS, conflict trackers, OSINT mapping
• [actor - e.g. UN / multilateral / humanitarian body]
  • Role / function:
  • Interest:
  • Capability:
  • Current posture:
  • Source basis:
  • Notes / tool output: ← UN OCHA, ICRC, MSF operational updates
• [actor - e.g. Client crisis management team / in-country contact]
  • Role / function:
  • Location:
  • Status: [Reachable / Communications-degraded / Evacuated]
  • Last confirmed contact:
  • Notes / tool output:
• [actor - e.g. External state actor / regional power with influence]
  • Role / function:
  • Interest:
  • Capability:
  • Current posture:
  • Notes / tool output:

Actor network summary

• Dominant actor (most able to determine trajectory):
• Swing actor (whose move would shift H1 to H2):
• Spoiler actor (capable of disrupting stabilisation):
• Client-actor liaison status:

06 · Events Timeline

Chronological record of crisis-relevant events from baseline through the current monitoring cycle. Each event is rated for significance and diagnostic weight on the active scenario assessment. Maps to the COP timeline layer and feeds OSINT-063-post-crisis-after-action-report §7 on resolution.

Timeline entry register

Clone per event. Anchor to date-time; note diagnostic weight. Add each cycle.

• [YYYY-MM-DD HH:MM - event description]
  • Category: [Security / Political / Humanitarian / Infrastructure / Meteorological / Health / Information / Diplomatic]
  • COP significance: [Critical / High / Elevated / Moderate / Background]
  • Scenario weight: [Consistent with H1 / Consistent with H2 / Consistent with H3 / Neutral / Ambiguous]
  • Source / grade:
  • Verification status: [Confirmed / Probable / Unconfirmed / Disputed]
  • Notes:
• [YYYY-MM-DD HH:MM - event 2]
  • Category:
  • COP significance:
  • Scenario weight:
  • Source / grade:
  • Verification status:
  • Notes:
• [YYYY-MM-DD HH:MM - ANTICIPATED - near-term event or decision point]
  • Category:
  • Type: [Calendar-anchored / Contingent / Threshold-triggered]
  • Significance / watch rationale:
  • Watch notes:

Timeline period markers

• Crisis onset confirmed date-time:
• COP as-of date-time (this cycle):
• Current phase: [Pre-crisis / Initiation / Escalation / Active / Stabilising / Recovery / Resolved]
• Anticipated phase-transition window:
• Key calendar events within monitoring horizon (elections, peace talks, seasonal cycle, etc.):

07 · Assumptions & Uncertainties

The assumptions underpinning the current COP assessment and the uncertainties that bound it. Linchpin assumptions are flagged - their failure would require immediate re-assessment and potential tier upgrade. Maps to the COP confidence layer and the escalation logic in §00b.

Key assumptions register

Clone per assumption. Flag linchpin status.

• [assumption - e.g. current baseline from OSINT-061 remains directionally accurate]
  • Basis for assumption:
  • Confidence assumption holds: [H/M/L]
  • Impact if assumption proves wrong:
  • Linchpin (collapse of H1 if wrong)?: [Y/N]
  • Observable test (how would we know it is failing?):
  • Notes:
• [assumption - e.g. host-government retains functional command and control]
  • Basis:
  • Confidence:
  • Impact if wrong:
  • Linchpin?:
  • Test:
  • Notes:
• [assumption - e.g. client personnel and assets remain in declared location]
  • Basis:
  • Confidence:
  • Impact if wrong:
  • Linchpin?:
  • Test:
  • Notes:
• [assumption - e.g. no significant exogenous shock (secondary crisis / natural event / cyber attack)]
  • Basis:
  • Confidence:
  • Impact if wrong:
  • Linchpin?:
  • Test:
  • Notes:
• [assumption - e.g. source feeds remain live and uncontaminated by deception / disinformation]
  • Basis:
  • Confidence:
  • Impact if wrong:
  • Linchpin?:
  • Test:
  • Notes:

Key uncertainties

• [uncertainty - e.g. threat actor intent not confirmed]
  • Impact on COP accuracy:
  • Collection that would reduce it:
  • Route to: [OSINT-061-real-time-situational-monitoring surge / specialist source / on-the-ground contact]
• [uncertainty - e.g. information environment contested / active disinformation campaign suspected]
  • Impact:
  • Notes: ← DFRLab, EEAS DisinfoLab, Logically, social-listening cross-check
• [uncertainty - e.g. communications blackout in affected area]
  • Impact:
  • Notes:

COP confidence assessment (cycle-level)

• COP accuracy confidence: [HIGH / MODERATE / LOW]
• Coverage notes (black spots, access denial, contested information):
• Overall situation assessment confidence: [HIGH / MODERATE / LOW]
• Confidence basis:
• Next COP validation:

99 · Collection Admin

Working register - audit trail behind the COP. Not a dashboard layer itself, but the evidentiary and administrative record that supports the COP and feeds OSINT-063-post-crisis-after-action-report Annex A - Sources & Methodology on resolution.

Source register (graded - Admiralty two-axis)

Every material datum traceable to a graded source. Master list; entries in §04 carry detail.

• [S-1 - source name / feed]
  • Type: [Primary / Secondary / Tertiary]
  • Reliability (A–F):
  • Credibility (1–6):
  • Date accessed:
  • Self-interest caveat:
• [S-2]
  • Type:
  • Reliability:
  • Credibility:
  • Date accessed:
• [S-3]
  • Type:
  • Reliability:
  • Credibility:
  • Date accessed:

Evidence archive

Capture each COP snapshot, flash alert, and source extract with hash and timestamp. Chain-of-custody pointer for post-crisis AAR.

• [capture ref - COP snapshot / alert / source extract + hash + file path + timestamp]:
• [capture ref 2]:

Open gaps / RFIs (running)

• [gap - source lane not returning - lane: - last data:] → collection action:
• [gap - actor intent not confirmed] → route to OSINT-061-real-time-situational-monitoring or specialist
• [gap - area of operations blackout - affected area:] → alternative source being sought:
• [gap - unverified claim - claim: - verification pending:]

COP revision log

Timestamped log of each COP update and tier change during the active crisis.

• [YYYY-MM-DD HH:MM - update description - tier before/after]:
• [YYYY-MM-DD HH:MM - update 2]:

Crisis lifecycle markers

• Monitoring opened:
• Current phase as-of:
• Escalation events (tier upgrades):
• De-escalation events (tier downgrades):
• Monitoring closed / handed to AAR:
• Handed to OSINT-063-post-crisis-after-action-report: [yes / pending / not yet]