3C-INT
[Cyber]Crime Characterization for Intelligence
3C-INT is a living actor-intelligence environment for teams that need more than profiles. It connects identity, aliases, documented relationships, Validity, related files, evidence, ATT&CK, Network Intelligence, STRATINT and defensive outputs without hiding the uncertainty behind the assessment.
- Actor identity and alias continuity
- Relationships with explicit temporal limits where known
- Evidence, OSINT and related technical artifacts
- Explainable network metrics and change signals
- Strategic, executive and defensive intelligence outputs
- Private organization intelligence governed by ownership and ACL
What is inside 3C-INT today
The product is built as an actor-centric intelligence system. Each surface answers a different analytical question instead of repeating the same profile in different formats.
Identity, aliases and actor continuity
Structured identity, aliases, categories and maintained profile context reduce duplicate research and naming drift across investigations.
Related profiles, Validity and related files
Canonical relationships carry type and temporal validity where confirmed; technical files and artifacts add context without becoming automatic attribution.
Actor Network Graph + Network Intelligence
Use the graph for 1-hop/2-hop orientation and Network Intelligence for deterministic metrics, composition and explainable temporal change over documented relationships.
STRATINT and living strategic assessment
Preliminary Strategic Intelligence, revisions and entitled STRATINT Updates keep strategic interpretation connected to the current actor profile instead of buried in static PDFs.
ATT&CK, hunting and IOC context
Documented techniques, hunting hypotheses, IOC material and related artifacts help defenders move from actor knowledge toward testable investigation.
Executive, evidence and private workflows
Threat Snapshot, Executive Brief, Country Context, OSINT, evidence and private-profile governance support different audiences without collapsing them into one certainty level.
Access changes the visible intelligence surface
Research is a registered, deliberately limited read-only surface. Analyst unlocks the expanded analytical layer inside the authorized universe. Admin adds organization governance; it does not remove object-level authorization or cross-tenant boundaries.
Role alone does not unlock private intelligence
Private profiles are governed by ownership, organization and ACL. An Analyst in the same organization does not automatically inherit access to every private profile; Admin can govern organization-owned private intelligence but does not cross tenant boundaries.
3C-INT use cases
The strongest use cases are not generic “actor research.” They are continuity problems: attribution drift, relationship change, defensive translation, material updates, private intelligence and briefing from evidence that remains traceable.
Access options
Use registered Research for limited public consultation, licensed Analyst for the expanded analytical surface, or Admin / Team when organization-level private governance is required.
Research
Registered, read-only access to public profiles through a deliberately reduced surface. Research is useful for orientation and selected public intelligence, not as a substitute for Analyst access.
- Public profiles inside the Research surface
- Restricted relationship and evidence metadata
- No Network Intelligence, Alert Center or Premium Updates
Analyst
Licensed analytical access for teams that need the full actor-intelligence workflow inside their authorized universe, including private profiles they own or are explicitly allowed to use.
- Network Intelligence and full relationship context
- Strategic, executive and defensive products
- Alert Center / Updates when entitled
Admin / Team
Licensed organization-governance layer for teams that need to manage organization-owned private intelligence, ACL, portability and STRATINT routing where enabled.
- Includes Analyst capabilities
- Organization-private profile governance
- ACL, portability and routing controls
Temporary evaluation access
Qualified organizations may request a controlled Analyst-level evaluation window. Approval, duration, authentication and scope remain explicitly managed.