Decision Intelligence

VIPER

From the incident to the evidence.

See the infrastructure behind an affected service. Follow physical connections, inspect original observations and investigate what should happen next.

Follow the incident Discuss a project
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

Harbor Operations Center

Queens, New York · 3D view

Opens atSW-01 · Eth1/24Building B · Room 02 · Row A · R12 · U40
3D · BUILDINGS · TERRAINHeights from source data; flat where unknown
Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient

Synthetic presentation data

Product walkthrough

One incident, followed from the map to the decision.

Three chapters, one incident: a degraded service at a New York operations center, followed through the picture, the infrastructure and the evidence.

Product walkthrough

Skip walkthroughContinue

01 VIPER Operational picture

From the operational picture to the component.

A degraded service appears in the New York picture. VIPER focuses the site and opens the affected interface directly.

  1. A.An incident in the operational pictureINC-024 appears at NYC-01: the Records Gateway is degraded at a New York facility.
  2. B.The site and the componentThe camera settles on Harbor Operations Center and the one component the evidence points to.
  3. C.Open the interface directlySW-01 · Eth1/24 opens with its current report: no walking the building, floor by floor.
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

Sites on the map

10 sites with a verified position · select a site to open its infrastructure

Lakeshore Regional OfficeSoutheast Regional OfficeCentral Records CenterMountain Regional OfficeSouthwest Field OfficeNorthwest Field OfficeNew York metro · 4 sites · 3 alertsHarbor Operations Center · 3 alerts Bronx Continuity SiteBrooklyn Field OfficeHudson Records Annex
Snapshot 2026-10-14 11:04:00 UTCDisplay context only · geography grants no authoritySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

Harbor Operations Center

Queens, New York · 3D view

Opens atSW-01 · Eth1/24Building B · Room 02 · Row A · R12 · U40
3D · BUILDINGS · TERRAINHeights from source data; flat where unknown
Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

SW-01 top-of-rack switch

Interface Eth1/24 · the highlighted link and possibly affected objects

  • Observed link · device-reported
  • Recorded dependency
  • Recorded network membership
  • Not observed
Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPER Operational Picture: ten sites across the United States, focusing the New York metro where NYC-01 Harbor Operations Center reports INC-024, Records Gateway degraded. The view then focuses the site in a three-dimensional street view and opens SW-01 Eth1/24 directly, with its current interface report: 2,210 input errors per five minutes against a baseline of two, link up, utilization normal.

02 VIPER Physical infrastructure

Follow the physical reality behind the service.

Rack faces, modules, ports, transceivers and the recorded patch path — with every missing record left visible.

  1. A.Building, room and rackRack R12 front and rear, with SW-01 at U40 and its power feeds on the rear face.
  2. B.Interface, transceiver and patch pathEth1/24, TX-24 and CBL-042 to PP-01 · P24 — then the recorded path, hop by hop, to the unresolved segment.
  3. C.Network, service and power dependenciesServices, servers, switches and power in one scene. Recorded, observed and missing relationships stay distinct.
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

Rack R12 · front and rear

Building B · Room 02 · Row A · recorded elevation · SW-01 Eth1/24 selected; Esc returns to the site

R12 · Front

  4. 3U open
  6. 10U open
  11. 11U open

R12 · Rear

  4. 3U open
  6. 10U open
  11. 11U open
Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

Recorded path · SW-01 Eth1/24 → SW-02 Eth1/08

8 hops · 6 surveyed · 1 documented · 1 segment not recorded

Recorded path · Primary uplink

SW-01 · Eth1/24 → SW-02 · Eth1/08

SW-01 Eth1/24 to SW-02 Eth1/08 through PP-01, TRUNK-07 channel 04 and PP-02.

  1. Row A · Rack R12

  2. Under-floor tray

  3. Row C · Rack R03

SurveyedDocumented onlyGap · no recordHighlighting marks where evidence points — it is not a finding.

TraceRecorded to TRUNK-07 ch04. The segment into PP-02 is unresolved: LLDP names the far end, no record maps the route to it. Errors are observed at Eth1/24 only — no component on this path is established as the cause.

Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

SW-01 top-of-rack switch

Interface Eth1/24 · the highlighted link and possibly affected objects

  • Observed link · device-reported
  • Recorded dependency
  • Recorded network membership
  • Not observed
Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPER physical view of rack R12 in Building B, Room 02, front and rear, with SW-01 at U40 and Eth1/24 selected; transceiver TX-24 and cable CBL-042 to PP-01 port 24. The recorded path continues through TRUNK-07 channel 04 to an unresolved segment into PP-02. The site scene shows service, server, network and power dependencies, including UPS-01, with the unrecorded segment marked; a recorded connection is not proof of a defect.

03 VIPER Evidence and investigation

Understand what the evidence supports.

Original observations keep their source and time. Explanations stay open until evidence separates them — and a person decides.

  1. A.Observations, before and afterTimestamped observations from their sources, and the same interface compared before, during and after the incident.
  2. B.VIPER AnalystAn evidence brief for human review: each hypothesis with supporting, contradicting and unresolved observations.
  3. C.Next verification, watch, decisionThe read that separates the alternatives, a saved watch — and the boundary: VIPER prepares, the decision owner decides.
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

INV-024 · Evidence

INC-024SVC-01 · Records Gateway

Incident window10:05–10:35 UTCcompared with Before window 09:35–10:05 UTC

Evidence · INC-024

Incident window · 10:05–10:35 UTC

Evidence · INC-024: observations with source, basis and freshness
TimeObservationBasis
10:07–10:35Measured
10:09–10:31Measured
10:05–10:35Measured
10:05–10:35Measured
10:05–10:35Measured
10:05–10:35Measured
10:05–10:35Not observed
10:05–10:35Not observed
10:38Adjacency

Comparison CMP-024-1

SW-01 uplinks on TRUNK-07: Eth1/24 (affected) and Eth1/23 (comparison)

Did input errors change with the incident — and did the other uplink change too?

Eth1/24 · primaryinput errors / 5 min
Peak 2,210

Eth1/24 · primary, input errors / 5 min: 09:35 0, 09:40 1, 09:45 0, 09:50 2, 09:55 0, 10:00 1, 10:05 312, 10:10 1846, 10:15 2210, 10:20 1975, 10:25 2032, 10:30 1418, 10:35 96, 10:40 41, 10:45 38, 10:50 44, 10:55 39

Eth1/23 · secondaryinput errors / 5 min
0 in every interval

Eth1/23 · secondary, input errors / 5 min: 09:35 0, 09:40 0, 09:45 0, 09:50 0, 09:55 0, 10:00 0, 10:05 0, 10:10 0, 10:15 0, 10:20 0, 10:25 0, 10:30 0, 10:35 0, 10:40 0, 10:45 0, 10:50 0, 10:55 0

Medians by window
MeasureBefore windowIncident windowAfter window
Eth1/24 · median errors / 5 min0.51,91141
Eth1/23 · median errors / 5 min000
SVC-01 check · p95 response0.42 s3.4 s0.61 s

Errors on Eth1/24 rose with the incident and stay above baseline after it. Eth1/23, on the same trunk, shows none — the change is specific to the channel 04 side.

VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

Operational Picture

SW-01 top-of-rack switch

Interface Eth1/24 · the highlighted link and possibly affected objects

  • Observed link · device-reported
  • Recorded dependency
  • Recorded network membership
  • Not observed
Snapshot 2026-10-14 11:04:00 UTCRecorded relationships · observed links · display context onlySynthetic presentation data · Map data © OpenStreetMap contributors
VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPERCYBERSECURITY INTELLIGENCEOPERATIONS · ALL SITESCREA-KO
VIPER CLIENT · AUTHORIZED OPERATIONS

INV-024 · Next step and review

INC-024SVC-01 · Records Gateway

Incident window10:05–10:35 UTC

Investigation INV-024

INC-024 · ASM-024 rev 3

Records Gateway degradation · errors on SW-01 Eth1/24

Why did the Records Gateway degrade between 10:05 and 10:35, and where is the fault?

Owneranalyst-b Analyst · shift B

Handed over11:00 from analyst-a

NV-024-1 pending: far-end counters due 11:30, optics scheduled 11:05. Assessment rev 3 current. DEC-12 in force: keep Eth1/24 in service.

PendingNV-024-1 · awaiting reads

Next verification · NV-024-1

Due 11:30 UTC

Do errors appear at the far end of the Eth1/24 path, and are TX-24 optical levels within range?

Separates
A fault before PP-01 (TX-24, CBL-042) from one beyond it (TRUNK-07 ch04, PP-02, CBL-043, SW-02).
Does not address
H3 — that needs SVC-01 application logs.
Interval
Incident window · 10:05–10:35 UTC
  1. Approved readTX-24 transmit and receive optical levelsSW-01 · Eth1/24 · now, then every 5 min for 60 minOwner COL-01 · read-only collector Scheduled 11:05
  2. Human requestSW-02 · Eth1/08 input error counters10:05–11:00 UTC · read-onlyOwner netops-shift-b · Network operations · shift B Requested 10:46 · due 11:30

Requested by analyst-a · Analyst · shift A at 10:46. Read-only: nothing is changed on SW-01 or SW-02.

Human review · INC-024

No decision recorded since DEC-12 · 10:55 UTC

Decision owner
ops-lead · Operations lead
Investigation
INV-024 · analyst-b · Analyst · shift B

Prepared by VIPER

  • Assessment ASM-024 rev 3 · alternatives open
  • Verification NV-024-1 · pending
  • Watch WCH-03 · approved, running daily

Not done by VIPER

  • Change switch configuration or move traffic
  • Reseat, replace or re-patch a component
  • Confirm a defective part without its evidence
  • Close the incident or accept a cause

Saved watch · WCH-03

Which critical services acquired a recorded single point of failure since yesterday?

Daily 07:00 UTC and after every record import · approved by ops-lead

Last run 07:00 UTC · 2 critical services changed

Physical work on SW-01, TX-24 or the PP-02 segment needs the decision owner’s authorization and a network operations change record. VIPER Administration keeps the application running; neither it nor Bridge executes network repairs.

VIPER · CREA-KOEvidence before conclusions · Explicit human authorityClient
VIPER investigation INV-024: original observations with time, source and freshness, and errors on Eth1/24 compared before, during and after the incident window against Eth1/23 on the same trunk. VIPER Analyst presents an evidence brief for human review with hypotheses, each with supporting, contradicting and unresolved evidence cited to observations. The next verification requests TX-24 optics and far-end counters, watch WCH-03 runs daily, and the operations lead is the decision owner.

Continue

Your environment

Installed on your server.
Administered inside VIPER.

VIPER Host installs on a supported server you own. A guided setup configures the database, the HTTPS address, your named administrators, the license and recovery; colleagues then install the signed client from the host’s own portal. Nothing else to buy or install first. The scope of a first deployment is set during evaluation.

Discuss a deployment

Customer environmentCustomer-hosted · Building B, Room 02

Approved existing sources

  • Interface counters and neighboursRead by collector COL-01 · read-only
  • Independent service checksCHK-RGW-01 scripted transactions from PRB-02
  • Infrastructure recordsDCIM import and field-survey revisions
  • Device-reported powerServer BMC, PDU per-phase metering, UPS

Each source keeps its identity. Nothing is collected that the profile does not name.

VIPER on a supported local profile

VIPER-OPS-01 · Production · NYC-01

  • APP-01VIPER serverWindows Server
  • COL-01CollectorWindows Server
  • WS-01Operator desktopWindows 11
  • WS-02Operator desktopWindows 11
  • HOST-07Sensor hostLinux · qualified profile
  • HOST-08Sensor hostLinux · qualified profile

Evidence, records and assessments stay inside this instance. Operators work in VIPER directly.

VIPER Administration, held by the customer

  • Accounts, roles and administratorsNamed people with scoped duties; an institutional profile requires a second person to approve a protected change.
  • License and signed updatesREL-024 verified and admitted before any target changed — with no vendor connection required.
  • Backups, health and recoveryRecovery material, database and model resources for VIPER-OPS-01, under the customer’s authority.

Administering this instance does not open VIPER evidence. Evidence access is a separate VIPER operational authorization.

Sources feed VIPER inside the customer environment. VIPER Host includes its own administration, client portal and signed updates; no separate product sits in the path of ordinary work.

  1. Start from what is already approved. Interface counters, service checks, infrastructure records and device-reported power — reused with their source identity and mappings.

  2. Run on a supported local profile. Servers, collectors and desktops are defined in the deployment profile; connected or disconnected operation depends on that profile.

  3. Keep the lifecycle under your authority. Setup, accounts, licenses and signed updates are administered inside VIPER. An optional Bridge console can later coordinate several CREA-KO applications; VIPER never depends on it.

Continue into VIPER.

Bring one real workflow to the evaluation.

Name the service, the environment and the workflow you want to examine. We scope the evaluation around them.

Discuss an evaluation Contact

Also seeDecision Intelligence