Review workspace
Routing observations
Investigate a change, inspect its evidence, and record what you can establish.
Start with the evidence
- Choose an observation. The list groups related route changes. A group is not a confirmed attack.
- Read the change and sources. An AS number identifies a network. A prefix is an IP address range. An origin is the network announcing that range.
- Record a supported conclusion. Explain which sources support it. Choose “Uncertain” when you cannot establish the cause.
Only mark a conclusion independently verified when you have checked supporting evidence yourself. Historical imports may not have a verified retrieval time.
Monitoring coverage
Suggested order puts pending reviews first, with conflicts and missing evidence before routine checks. Historical imports follow collected observations.
Begin a review
Select an observation
Choose a network from the list to see what changed and which evidence is available.
New observations appear automatically. Your selection and unfinished review are preserved.
Observation
What was observed
Observation timeline
Recorded assessment
Source evidence
Expand a source for readable fields. The original record is available under each source.
Your conclusion
Saved reviews are attributed to your account. Earlier versions remain in the history.
- Confirm what this observer actually saw.
- Check authorization at the event time and independent operator context.
- Link the evidence below. Leave the conclusion uncertain if the cause is unresolved.
Review history
Administrator
People & access
Create a named account and share its private setup link with that person. Links expire after 24 hours and can be used once. Viewers can read evidence; reviewers can also save conclusions.
This link grants access to the private workspace. It is shown here once; a pending account can receive a replacement below.
Evidence & evaluation
What the reviews establish
Exports include reviewer names and reasoning. Keep them private. The snapshot can be evaluated again with the same threshold and checksum.
Service protection
Checking backup and alert status…