Explain with me, not at me.

Plain-language identification of the signal: source, observed time, freshness, confidence, location, and category. Every evidence record keeps the source name, source identifier, collector version, source record label, and cockpit mapping time attached — so the answer to “what am I looking at?” is never a guess.

The collection path and mapping reason are visible: which collector supplied it, which layer it belongs to, and why the cockpit thinks it belongs there. Confidence is a 0–100 number kept distinct from severity — a high-severity signal with low confidence stays loud and uncertain, not quietly upgraded.

Every signal lives in a relationship web — nearby assets, correlated signals, historical patterns, unusualness, source credibility, downstream implications. Watchlist matches against regions, companies, assets, routes, keywords, CVEs, and vendors are deterministic and recomputed on every snapshot.

Source excerpts, related observations, field notes, graph edges, and confidence factors are surfaced together. The cockpit keeps both the operator-facing evidence record and the supporting source artifact: the record is what the interface reads, and the artifact is what audit trails point back to. A signal is only plotted on the map if it has valid coordinates from its source — non-geographic intelligence lives in dedicated panels, never invented onto arbitrary points.

Stale data, contradicted reports, low-confidence geocoding, duplicate source chains, known false-positive patterns, and degraded source health all show up next to the signal — not buried. Source health (online / degraded / offline) is derived from recent collection status, warnings, and records needing review, never assumed.

When evidence runs out, the cockpit says so — explicitly, in the same place the answer would have gone. Unknowns are treated as a first-class output, not a missing-data error.

The six questions above are not steps — they're the inside of one recurring loop you learn almost instinctively: watch the map for motion, silence, and change; inspect a signal for what / when / where / source / confidence; connect it to related signals, entities, and infrastructure in the graph; question the cluster (“why is this forming?”, “what changed here in the last six hours?”); co-explain with structured evidence, uncertainty, and citations; annotate with a field note attached to signal, place, or time window; promote notes that later signals support or trusted analysts reuse; and end with a briefing — not a chat reply, but a living intelligence object carrying map state, sources, graph links, notes, confidence, and open questions. Everything else in the product supports that loop.