Information landscape and signal streams

Detection principles

A venue on the open web, identified by a domain name and accessible via a URL, that hosts content directly under its own control rather than within a platform-managed environment.

Website

The smallest recorded unit of engineered activity. Holds the Assets, Publications, TTPs, Narrative and Sub-Narrative, venues and timing of one episode.

Incident

 A specific instantiation of a Narrative that adds the operational "how" or "what" — the mechanism, context, or case that explains how the Narrative manifests; structured as Agent | Operator | Target | Specifier.

Sub-Narrative

An Asset whose identity and operator the client already knows — either because they own it or because they treat it as a known reference point — held outside the classification pipeline so it can serve as a fixed measurement anchor in the Landscape.

Reference_Asset

Any single piece of content captured by Vantage — a post, article, share, or repost — produced by an Asset.

Publication

A digital service that hosts user-generated content and provides distribution mechanisms — accounts, channels, groups, feeds — through which Assets produce Publications and Narratives circulate.

Platform

The first Publication identified as the originating point of a Narrative, Influence Operation, or other tracked unit of activity.

Patient_Zero

The category of intelligence that surfaces who is shaping a target's Information Landscape, through which Assets they are doing it, and what action they are engineered to drive — turning chatter into defensible signal about adversarial behaviour.

Narrative_Intelligence

A cluster of trending real-world discussions or events that activates or reactivates a Narrative or Sub-Narrative in the information landscape, surfacing why audiences engage with the Narrative at a given moment.

Narrative_Trigger

A recurring pattern of meaning that frames how an individual or group understand events, and through that framing, shapes the actions they take; structured as Agent | Operator | Target.

Narrative

A prefix indicating presence or footprint across more than one instance of a given dimension — platform, country, language, Actor, Narrative — without an analytical claim that the instances are connected.

Multi-

The openly maintained framework that catalogs the tactics, techniques, and procedures used by cyber adversaries — the reference taxonomy security operations teams use to describe how attackers operate.

MITRE_ATTCK

False or misleading information shared without intent to deceive.

Misinformation

A publishing entity defined by editorial identity and output — newspapers, broadcasters, magazines, online news sites, wire services — whose presence in an Information Landscape is registered as one or more Assets across the venues it operates on.

Media_Outlet

True or accurate information shared with intent to harm, through selective release, hostile framing, or weaponized timing.

Malinformation

An Asset with a documented behavioral track record warranting elevated scrutiny — a designation applied to an existing Asset record, expressed as an Evidence Score of Possible, Probable, or Confirmed.

Known_Asset

The objective an Influence Operation is designed to achieve — recorded as a required data object on every IO. It can also be used descriptively at the level of Narratives, Assets, etc., without the same structured form.

Intent

The use of information and information infrastructure as a strategic weapon between states or organized actors to achieve strategic outcomes.

Information_Warfare

A defined part of the media and social media space — the set of channels, pages, accounts, groups, and domains (Assets) whose activity targets a specific individual or group of individuals.

Information_Landscape

A deliberate, organized effort to drive an individual or group of individuals to take an action, or to refrain from one, by weaponizing information and the infrastructure that distributes it.

Influence_Operation

The accumulating measure of evidence recorded against an Asset that determines whether and at what status it becomes a Known Asset.

Evidence_Score

False or misleading information created and spread with intent to deceive.

Disinformation

An open-source framework and detailed taxonomy designed to identify, analyze, and counteract influence operations by mapping the specific tactics, techniques, and procedures (TTPs) used by threat actors.

DISARM_Framework

AI-generated and AI-altered media artefacts across all formats: video, audio, image, and text.

Deepfake

A prefix indicating movement or flow of a phenomenon across the boundary of a given dimension — platform, country, language, Actor, Narrative — where the boundary-crossing is itself the analytical claim.

Cross-

An Information Landscape scoped to a target country — defined by who is being targeted (the country's population, organisations, and decision-makers), not by where the Assets producing content are based. 


Countrys_Information_Landscape

Coordinated activity across multiple Assets in which the coordination itself involves inauthenticity — automation, fake identity, manufactured engagement, or account manipulation — used to manipulate audiences while concealing the operation's nature.

Coordinated_Inauthentic_Behavior

A six-point scale for measuring the spread of an Influence Operation by how far its content has broken out from its origin, from a single closed community at the low end to mainstream news coverage and policy response at the high end.

Breakout_Scale

A bot network is a set of accounts under common control that act in coordination, based on observable behavioural and structural signals. Such signals include synchronized posting, shared content templates, overlapping follower graphs etc.

Botnetwork

A bot is an account exhibiting behavioral signatures consistent with automation — for example, posting volume or timing inconsistent with human use, near-instant resharing across accounts, templated content, or activity patterns lacking the irregular

The category LetsData uses to refer to the tactics, techniques, and procedures observed in adversary activity — covering both Influence Operation tradecraft (mapped via DISARM) and cyber tradecraft (mapped via MITRE ATT&CK), under one umbrella.

TTPs

Amplification is the deliberate or incidental boosting of a piece of content, narrative, or account beyond the predicted reach it would attain through organic distribution. 

Amplification

A principal — state, organization, network, or individual — that originates, directs, funds, or executes activity in the information landscape.

Actor

Any account, page, channel, or website captured by Vantage within an Information Landscape, capable of producing Publications, and engaging with other Assets.