Overview#
A duty officer on a joint NATO watch floor receives concurrent reports: an acoustic sensor triggered in the maritime zone, a COMINT intercept from a different area, and a cyber alert flagged by a partner nation's SOC. Without a fused picture, deciding whether these are separate events or one coordinated pattern takes precious minutes and multiple system logins. The Cross-Domain Fusion Workspace puts all three on a single screen within seconds.
The workspace aggregates entities from land, air, sea, cyber, space, and coalition activity into one countable operational view, then shows how that activity distributes across domains. Defence organisations, intelligence fusion centres, and critical national infrastructure operators across government, energy, and telecommunications sectors use this layer as the command surface before deeper specialist analysis begins.
Key Features#
- Multi-Domain Entity Aggregation: Consolidates entities from TAK, DIS, STIX, ISR, and related integrated standards into a single operational picture covering land, air, sea, cyber, space, and coalition contexts. All entity records are scoped to the owning organisation with multi-tenant isolation enforced at query time.
- Domain Distribution View: Displays how fused entities are distributed across domains so operators can quickly spot where activity is concentrated, identifying asymmetric patterns that warrant escalation.
- Active Entity Tracking: Surfaces current active-entity counts separately from inactive or historical context, giving watch officers a live operational count rather than an inflated cumulative figure.
- Standards Awareness: Shows how many integrated source standards are contributing to the current picture, helping operators gauge the breadth of correlation and identify missing feed coverage.
- Rapid Pivot to Command Workflows: Serves as a launch surface into deeper operational command environments when the fused summary shows abnormal activity, maintaining entity context across the navigation.
Use Cases#
- Command Floor Awareness: Duty officers maintain a constantly refreshed cross-domain picture before deciding which specialist team should take the next action, reducing decision latency on a congested watch floor.
- Multi-Agency Mission Correlation: Joint operators correlate cyber, ISR, tactical, and coalition inputs to understand whether seemingly separate events belong to the same operational pattern.
- Executive Operational Briefings: Supervisors summarise current activity distribution across mission domains during briefings without opening multiple specialist dashboards.
- Escalation Decision Support: Analysts use the fused count and domain spread to determine when to escalate from overview monitoring into dedicated tactical, ISR, cyber, or earth observation workflows.
Integration#
- Operational picture services aggregating multi-standard entity feeds
- TAK, DIS, STIX, ISR, and related integrated standards (153 total platform integrations)
- Shared dashboard shell and hub-launch workflows
- Downstream command-and-control workspaces for deep operational analysis
Open Standards#
- OASIS STIX 2.1 / TAXII 2.1: Cyber threat intelligence bundles are ingested directly from TAXII collection feeds and exported as STIX 2.1 bundles, placing cyber-domain indicators into the fused operational picture alongside physical-domain entities.
- IEEE 1278.1 (Distributed Interactive Simulation): Entity State PDUs from live or exercise DIS networks are parsed and normalised into the fusion layer, contributing land, air, and sea simulation entities to the shared count and domain distribution view.
- Cursor-on-Target (CoT) 2.0: TAK network position reports are ingested as CoT XML events and tracked as active entities, providing the land and coalition-force layer of the fused picture.
- STANAG 4607 (GMTI): Ground Moving Target Indicator packets from airborne ISR sensors are parsed at the binary PDU level, with each target dwell emitted as a fused track contributing to the air and land domain counts.
- NATO AJP-27 (JISR): Joint Intelligence, Surveillance and Reconnaissance collection requests are submitted and tracked under the AJP-27 standard, linking ISR tasking to the operational entities visible in the workspace.
- STANAG 4774 / ADatP-4774: Every fused entity carries an XML confidentiality metadata label serialised to the STANAG 4774 PolicyContent schema, enforcing classification markings across all source standards at query time.
- STANAG 4778: Security labels are bound to inter-service HTTP responses via the X-Security-Label header per the STANAG 4778 binding specification, ensuring classification propagates when entities are shared with downstream command systems.
- MITRE ATT&CK: Cyber entities ingested from STIX bundles carry ATT&CK technique identifiers (e.g. T1003), allowing the workspace to surface adversary technique context alongside the physical-domain entity count.
Last Reviewed: 2026-03-24 Last Updated: 2026-04-14