A comprehensive reference covering all intelligence collection disciplines — SIGINT, IMINT, MASINT, OSINT, HUMINT, GEOINT, ELINT, and CYBER INT — what each data type represents, how it is collected and processed, and the joint fusion workflows that turn disparate observations into actionable intelligence products.
Each discipline collects fundamentally different phenomenology. Understanding what data each type actually measures — and critically, what it cannot see — is the prerequisite for effective multi-source fusion.
Each tile area reflects the relative analytical breadth and sub-discipline count of that INT family. Parent tiles show the top-level discipline; child tiles show every named sub-discipline. Hover any tile for a precise definition.
Seven interactive diagrams covering the JDL Fusion Model, INT-to-product data flow, sensor coverage gap analysis, correlation mapping, and the three primary joint exploitation workflows.
How strongly each pair of INT disciplines can be directly correlated to reinforce a product. HIGH = direct technical or temporal correlation possible; MEDIUM = correlation with transformation or temporal tolerance; LOW = indirect / via common framework only.
Each INT layer contributes a distinct class of information about the same target. Stacked together they produce a decision-grade intelligence picture no single discipline can achieve alone. Hover each layer to see what it adds.
| Field | Value | Source INT | Confidence |
|---|---|---|---|
| System Name | SA-21 GROWLER (S-400 Triumf) | OSINT / TECHINT | HIGH |
| NATO Reporting Name | SA-21 GROWLER | DIA TECHINT Library | HIGH |
| Emitter Designation | 91N6E BIG BIRD Acquisition Radar | ELINT Parametric | HIGH |
| Frequency Band | S-band · 2.7–3.7 GHz (observed: 3.12 GHz) | ELINT RC-135U | HIGH |
| Pulse Repetition Frequency | 250–400 Hz (mode-dependent; observed: 312 Hz) | ELINT parametric capture | MED |
| Pulse Width | 3.5 µs (acquisition mode) | ELINT RC-135U | HIGH |
| Scan Rate | 6 rpm azimuth / electronic elevation | ELINT time-on-target | HIGH |
| Frequency Agility | Confirmed (pulse-to-pulse hopping observed) | ELINT wideband receiver | MED |
| Max Instrumented Range | ~600 km (track); ~400 km (engagement) | OSINT / TECHINT | MED |
| Altitude Coverage | 5 m – 30,000 m | OSINT specifications | MED |
| Location (last observed) | 41.912°N 044.538°E · Grid 38TLL 4894 1309 | GEOINT / SIGINT geolocate | HIGH |
| Operational Status | ACTIVE — emitting as of 14:18 UTC | ELINT real-time | HIGH |
| Unit Association | 8th Air Defence Brigade, assessed | SIGINT COMINT / HUMINT | LOW |
| Jamming Susceptibility | Low (ECCM observed); sidelobe suppression active | ELINT EW analysis | MED |
| Associated Fire Control | 92N2E GRAVE STONE (track + engage radar) | ELINT co-located emitter | HIGH |
| Missile System | 40N6E / 48N6 interceptors assessed on-pad | IMINT SAR change detect | MED |
| EOB Entry Date | Current collection period · Last updated 14:22 UTC | All-source fusion | HIGH |
Representative examples of the actual data product each INT discipline produces — formatted as analysts receive them. The Electronic Order of Battle (EOB) example shows how ELINT, SIGINT, IMINT, and MASINT outputs are fused into a single authoritative threat register.
| Feature | Count | ID Method | Assessment | Conf |
|---|---|---|---|---|
| Fighter aircraft, twin-engine | 8 | Shadow length 14.2m → matches F-15 (18.45m) or Su-30 (21.9m). Wing geometry → F-15SA | F-15SA Eagle (RSAF) | HIGH |
| Tanker aircraft, 4-engine | 2 | Fuselage width 6.5m, wing sweep 37°, refuelling boom visible | KC-135R Stratotanker | HIGH |
| Fuel bowser vehicles | 4 | Vehicle dimensions 8×3m, hose connections active (shadow detail) | Active refuelling ops in progress | MED |
| Hardened aircraft shelter (HAS) | 6 | Arched structures, 3 doors open, 3 closed — thermal IR pass confirms 3 warm engines | 3 ac sheltered, engines warm — possible alert status | MED |
| New revetment construction | 1 | Earthwork scarring, 2× D9 bulldozers, spoil pile SE corner — not present D-30 baseline | Force protection upgrade — ballistic revetment for missile storage probable | LOW |
| Parameter | Measured Value | Library Match | Delta |
|---|---|---|---|
| Shaft rotation rate (fundamental) | 4.2 Hz | VICTOR III: 4.1–4.3 Hz | +0.1 Hz — within tolerance |
| Blade rate (7-blade prop × shaft) | 29.4 Hz | VICTOR III: 28.7–30.1 Hz | Match |
| Machinery noise at 50 Hz | −42 dB re 1µPa/√Hz @ 1km | VICTOR III library: −40 to −45 | Within bounds |
| Narrowband tonal at 112 Hz | Present, −38 dB | Known VICTOR III cooling pump harmonic | Positive ID indicator |
| Broadband noise level | +3 dB vs library | Elevated vs baseline VICTOR III | Possible maintenance issue or speed increase |
| Cavitation onset speed | Not yet cavitating at est. 8 kts | VICTOR III cavitates above 14 kts | Consistent |
| Feature | Dimension / Detail | Assessment |
|---|---|---|
| Portal A (N face, NW) | 8.2m W × 5.8m H, concrete surround, blast door evident | Primary vehicle/equipment access — hardened |
| Portal B (N face, NE) | 4.1m W × 3.8m H, personnel door visible | Personnel access / secondary egress |
| Power infrastructure | 3× high-tension lines from NE, transformer yard 200m E | Industrial power load — consistent with centrifuge or processing |
| Ventilation shafts | 6 shafts identified by disturbed ground 50–200m from portals | Underground facility depth >50m — consistent with WMD hardening |
| Security perimeter | Triple fence, 4 guard towers, vehicle chicanes, 30m exclusion zone | Above-standard security — WMD or strategic programme probable |
| Parameter | Measured Value | Tolerance / Notes |
|---|---|---|
| Frequency (nominal) | 2,850 MHz | S-band. Agile range: 2,700–3,100 MHz observed (16 hop values) |
| Pulse Width (PW) | 3.2 µs (search mode) / 1.1 µs (track mode) | Dual-PW indicates TWS capability |
| Pulse Repetition Interval (PRI) | 3,333 µs (staggered: 3,250 / 3,416 µs) | PRF staggering — ECCM capability |
| Scan Rate (azimuth) | 6 rpm standard / 12 rpm in alert mode | Mode change observed at T+14min — possible track initiation |
| Scan Type | Circular (search) / Sector (acquisition) | Sector scan centred 270° ± 35° — cued west |
| Polarisation | Linear vertical (search) / Circular (track) | Polarisation switching — stealth-detection optimised |
| Peak Power (est.) | ~1.8 MW (intercept power back-calc) | Long-range search radar — est. instrumented range 450km |
| Antenna rotation | Azimuth 360°, elevation 0–60° | 3D radar — height-finding capability confirmed |
| IoC Type | Value | Attribution Link |
|---|---|---|
| C2 IP Address | 103.27.108.244 (HK ASN) | Previously attributed to APT41 in 2023 campaign (Mandiant) |
| C2 Domain | update-service[.]cloudapp[.]net | Domain registration pattern matches APT41 infrastructure cluster |
| Malware hash (SHA256) | a3f9c8...d447e1 (SANDSTRIKE loader) | Code similarity 94% to APT41 DEADEYE loader (2022) |
| PDB path artefact | C:\Users\admin\Desktop\SandS_v3\Release\loader.pdb | Cyrillic filename artefact in adjacent strings — possible false flag or multilateral op |
| Mutex | Global\\{4A8F2B91-CC43-4d7e-B3FF-...} | Exact mutex match to APT41 COLDBREW tool (FireEye 2021) |
| Staging directory | %TEMP%\\SystemCache\\svchost32.dll | Known APT41 LOLBin staging pattern |
Each workflow defines which INT disciplines contribute at each phase, what data type is handed off, latency constraints, and the decision product at output. Click any card to expand the full workflow specification.
Target development is the end-to-end process by which multi-INT collection is fused into a legally-reviewed, commander-authorised, effects-calibrated decision to act. Each phase is a distinct intelligence hand-off — and each requires a different combination of INT disciplines. No single source can carry a target from nomination to BDA alone.
| F3EAD Phase | Primary INT Inputs | Data Product Consumed | Output / Hand-Off Product | Latency Target | Failure Mode if INT Missing |
|---|---|---|---|---|---|
| FIND Nominate target |
SIGINTOSINTHUMINT | SIGINT activity indicators, OSINT geospatial cue, HUMINT source report | Target nomination with initial grid ±500m, assessed entity type, PIR linkage | Hours to days | No nomination — target never enters development cycle |
| FIX Confirm location |
IMINTGEOINTSIGINT | EO/SAR imagery, SIGINT TDOA geolocate, GEOINT terrain reference | Precision coordinates ±10m CEP, confirmed physical presence, pattern-of-life baseline | 15 min – 6 h | Target fixed at wrong location — weapon misses or hits wrong object |
| CHARACTERISE Assess capability |
ELINTMASINTIMINT | ELINT parametrics (radar type, mode), MASINT RCS/thermal, IMINT dimensions and hardening | Target type confirmed, vulnerability assessment, hardness estimate, weapon selection input | 1 – 24 h | Wrong weapon selected — insufficient effect, or disproportionate effect |
| INTENT CHECK Assess purpose |
HUMINTSIGINTOSINT | HUMINT source reports on use / occupancy, COMINT operator orders, OSINT open-source verification | Dual-use assessment, civilian presence estimate, commander intent confidence level | Hours to days | Civilian or protected-site targeting — IHL violation, strategic-level consequences |
| WEAPONEER Select effects |
GEOINTMASINTIMINT | GEOINT precision aimpoint (±0.5m mensuration), MASINT hardness estimate, IMINT proximity mapping | Target Intelligence Package (TIP): aimpoint, weapon type, fusing, approach axis, CDE value | Hours (deliberate) / mins (TST pre-built) | Wrong aimpoint or weapon — structural miss or collateral damage excess |
| FINISH Execute effect |
SIGINTIMINT | Real-time SIGINT activity confirmation (target still present), ISR sensor cueing for terminal guidance | Weapons release — effect delivered against authorised target | Real-time | Target has moved (no SIGINT confirmation) — weapon hits empty objective |
| EXPLOIT Collect at site |
HUMINTMASINTSIGINT | Sensitive site exploitation (SSE) by HUMINT teams, MASINT CBRN clearance of site, SIGINT capture of any residual traffic | Exploited materials, biometric data, documents, device forensics — feeds new target development cycles | Hours post-strike | Intelligence opportunity missed — no insight into adversary network or follow-on targets |
| ANALYSE Assess effect |
IMINTSIGINTHUMINT | IMINT change detection (BDA imagery), SIGINT adversary reaction traffic, HUMINT ground reporting on damage | Battle Damage Assessment (BDA): effect achieved grade (D1–D5), re-attack recommendation, JTL update | Minutes – 24 h | Unknown effect — re-attack risk (wasted weapons) or unreported miss (target still operational) |
| DISSEMINATE Update the picture |
GEOINTOSINT | All-source BDA fusion product, updated GEOINT baseline, OSINT open-source confirmation / denial | Updated JTL, revised EOB, new intelligence requirements for follow-on cycle — loop restarts at FIND | Hours | Stale picture — commanders make follow-on decisions on outdated intelligence |
Each chain traces a causal pathway from a single-INT observation through fusion layers to a decision-grade product. These are the intellectual architecture of all-source analytical tradecraft.