Docs

On this page

Every committed doc, by what it is for. The CLI's commands are in the CLI README; each crate has its own README.

Guides#

Task-oriented: how to do one job end to end.

Doc	Covers
Admin workflow	The admin's day: watch digest, review, case, contacts, drafts, send, notice, updates.
AI assistance	Where a model helps (suggestions, triage, rule upkeep, drafting, monitoring), what it may see, what stays human.
Evaluating leads	Labelling leads well: what each label means, deciding a group, the traps, worked examples.
For operators	For a site that received a report: what it means, telling it is genuine, checking logs, sending logs back, replies, verifying a bundle, private contact.
For providers	For an AI provider that received a report: what it holds, checking the bundle, STIX and MISP exports, the publication clock, how it is named, replies.
For researchers	For outside researchers: the workbench on your own exports, rules and tactics, citing the manual, reproducing the evaluation, what is never shared.
Writing rules	Adding or changing a rule: fields, weights, links, hard negatives, the evaluation and the gate.

What each part does and how it is configured.

Doc	Covers
Watch runs and review	The data directory, incremental collection, the digest, retention, reviewing leads.
Case files	Case files: `case.toml`, every `case` subcommand, contacts, drafts, bundles, pinned rules, STIX and MISP exports, incident drafts, operator evidence.
The inbox	Outside submissions: transports, `inbox` commands, storage, other formats, intake caps, verification by id, triage and its settings, promotion.
Notices	Drafting, adding and updating notices; what they withhold; lint and build.
Declared agent identity	Declared agent identity: the catalog, `identity refresh` and `check`, the classes, report lines and suggested claims.
Evaluation	`swarmchase eval`, the CI eval gate and its floors, the held-out measurement.
Browser toolkit	The Pages site: how it is built, each page, the workbench, and how it keeps payloads inert.
Configuration	`env.list`, environment variables, the urlquery.net key and terms.
CI on a self-hosted runner	The workflows, secrets and variables, caches outside the checkout, runner requirements.

Doc	Covers
Methodology	How records become tiers, clusters, hints and claims, and the known limits.
Policies	Collection, attribution, reporting and publication.
Swarmchasing Field Manual (SC-FM 1.1)	The Swarmchasing Field Manual (SC-FM): the method as a citable standard, with stable section ids.

Formats other groups can implement, each with a JSON Schema under schemas/.

Doc	Covers
Specs	Index of the specs and their versions.
SC-Rules v1: indicator rules format	SC-Rules v1: the indicator rules file, scoring semantics and conformance vectors.
SC-Incident v1: incident interchange format	SC-Incident v1: one JSON document per published incident.
SC-Sightings v1: sharing what a swarm left in your logs	SC-Sightings v1: an operator's sightings of a swarm, shared without its logs, and matching across operators.
SC-Submission v1: outside swarm reports	SC-Submission v1: an outside report of agent activity, evidence typed by how it can be checked.
Adopting the method	How another group adopts the method and states conformance.
`schemas/sc-bench-v1.json`	SC-Bench v1: a labelled set, by record id, that other detectors are scored against (evaluation).

Doc	Covers
`CONTRIBUTING.md`	The hard rule, the gates, conventions, contributing a rule.
`scripts/README.md`	Every script and gate, and where each runs.
`samples/eval/README.md`	The labelled evaluation set and the held-out Transluce steps.
`samples/showcase/README.md`	The synthetic set the landing page walks through.
`samples/submissions/README.md`	Synthetic SC-Submission, STIX, X-ARF and IODEF reports.