Intelligence Sources
Identify scheduled feeds, internal observations, reference overlays, and source-health signals
The Situation Room combines scheduled upstream feeds, event-driven Y2 observations, specialized tracking and market tables, and curated reference overlays. These source classes have different refresh and health semantics; a layer name does not imply a continuously streaming provider.
Inspect source status
Open Situation Room
Open the monitor, then select Sources in the header. The page requires the same Lite, Pro, or Elite Situation Room access as the monitor.
Identify the source class
Runtime feeds display circuit-breaker state. Map overlays and reference networks are catalog entries and do not have the same fetch-health record.
Read the timestamps and errors
Runtime cards show the last successful fetch, consecutive failure count, current state, last error when present, and related map-layer IDs.
Confirm source-specific freshness
Compare the card with the schedules below. A closed circuit means requests are allowed; it does not prove that every row is recent or that every endpoint inside an aggregate source succeeded.
Scheduled upstream feeds
The following jobs are registered in the current Convex cron configuration.
| Source | Stored data | Current schedule |
|---|---|---|
| USGS | Earthquakes | Twice hourly at :05 and :35 |
| GDACS | Global disaster alerts | Twice hourly at :05 and :35 |
| NASA EONET | Natural-event observations | Twice hourly at :05 and :35 |
| OSINT RSS | Categorized headlines from 24 feeds | Twice hourly at :07 and :37 |
| NASA FIRMS | Active fire detections for configured regions | Twice hourly at :10 and :40 |
| Polymarket | Prediction markets | Every 15 minutes |
| Kalshi | Prediction markets | Twice hourly at :24 and :54 |
| URLhaus and Feodo Tracker | Malware URLs and command-and-control infrastructure | Twice hourly at :12 and :42 through a serialized work pool |
| NVD | CVE changes | Every 6 hours at :15 |
| CISA KEV | Known Exploited Vulnerabilities catalog | Daily at 04:20 UTC |
| FRED | Macroeconomic indicators | Twice hourly at :14 and :44 |
| Yahoo Finance markets | Market, commodity, FX, crypto, rate, and volatility indicators | Every 15 minutes at :04, :19, :34, and :49 |
| EIA spot series | WTI, Brent, and Henry Hub series | Hourly at :21 |
| EIA release series | Weekly and monthly energy series | Daily at 14:30 UTC |
| EIA nuclear outages | Facility outage snapshot | Daily at 14:45 UTC |
| EIA grid load | Six US balancing-authority series | Hourly at :33 |
| EIA crude imports | Per-port monthly data | Monthly on day 1 at 15:45 UTC |
| USNI Fleet Report | Naval vessel disposition | Daily at 06:20 UTC |
Schedules describe when Y2 attempts a fetch. The upstream dataset can update more slowly, return no rows, rate-limit a request, or be unavailable.
Hazards and earth observation
OSINT RSS headlines
The OSINT map pipeline has its own 24-feed registry, separate from the 40-topic News Signal Feed. It includes:
The adapter infers category and severity from source defaults plus headline and description keywords. It also attempts place and incident resolution only for items that have coordinates. Feed requests run in batches of five with a ten-second timeout per feed.
The Sources page reports one aggregate rss circuit. A sync is treated as successful when at
least one of the 24 feeds succeeds, so a closed RSS circuit does not guarantee that every feed
was available during the last run.
Cyber intelligence
Y2 stores multiple cyber source types with different cadences and downstream representations.
| Source | What it contributes | Important boundary |
|---|---|---|
| URLhaus | Active malware distribution URLs and related host indicators | Each sync is capped by the adapter and resolved into ontology entities when possible |
| Feodo Tracker | Botnet command-and-control IP or host infrastructure | Shares the serialized cyber ingestion work pool with URLhaus |
| NVD | Vulnerability records updated in the last-modified window | Six-hour delta ingestion; it is not the same as a full NVD backfill |
| CISA KEV | Vulnerabilities known to be exploited | Daily catalog sync; KEV status is an exploitation signal, not a severity score by itself |
URLhaus and Feodo observations power the Live Malware and network-intelligence surfaces. NVD and CISA KEV also feed the broader Cyber experience and ontology. Free workspaces can use the in-app Cyber surface, while Situation Room access still requires Lite or higher. New scoped API keys require Pro or Elite.
Markets and financial intelligence
Prediction markets
Polymarket and Kalshi records are normalized into the prediction-market table and also written to the ontology market model when subject entities can be resolved. Market questions are associated with countries using provider metadata and configured text matching.
A market probability is a market price, not a verified forecast or Y2 confidence score. Review liquidity, resolution terms, end date, and source URL before using it as evidence.
FININT feeds
The desktop FININT panel groups normalized indicators into Markets, Energy, and Macro segments. FRED, the scheduled Yahoo Finance market adapter, and the EIA family use the cadences in the table above.
Country cards use a separate Yahoo Finance index adapter. When requested, it fetches the configured primary index for the selected country, calculates an approximately five-trading-day change, and caches that result for one hour. That on-demand country-index lookup does not have its own recurring cron.
In-app FININT is available in Lite, Pro, and Elite. New intel:finint API keys require Pro or
Elite; existing Lite keys can retain compatibility limits while the workspace remains on Lite.
Military and navigation tracking
Aircraft Tracks
The Wingbits aircraft adapter and map layer remain in the repository, but scheduled aircraft
scans have been disabled since May 8, 2026. Re-enabling requires both cron entries and the
WINGBITS_AIRCRAFT_TRACKING_ENABLED environment flag.
The wingbits source-health card is shared with GPS-interference ingestion. It can look healthy
because GPS jobs are succeeding even though automatic aircraft tracking remains disabled.
GPS Interference
Wingbits navigation-accuracy observations are stored as H3 zones with sample count, aircraft count, average navigation accuracy, and normalized severity. The 22 configured theaters use four cadence tiers:
| Tier | Cadence | Coverage count |
|---|---|---|
| Hot | Hourly | 6 theaters |
| Watch | Every 3 hours | 8 theaters |
| Perimeter | Every 6 hours | 5 theaters |
| Verification | Daily | 3 theaters |
GPS zones expire after 30 minutes. A lower-cadence theater can therefore have no current map row between scans; absence is not evidence that interference stopped.
Naval Vessels
The USNI adapter ingests fleet-report-derived vessel positions once daily. Stored rows expire after 24 hours and include vessel class, status, region, strike-group context when present, and a confidence label. The upstream report itself is not a live AIS stream.
Internal and recognized source types
The Sources screen also lists identifiers that are not independent scheduled provider feeds:
Reference overlays and media
Reference cards do not use runtime circuit-breaker health. They describe data bundled into or referenced by the frontend:
- Curated satellite category anchors for the current Space toggles. CelesTrak and SatNOGS are listed as candidate/reference catalogs; the map is not presenting live orbital propagation from those providers.
- Curated undersea-cable routes with Submarine Cable Map lineage.
- Y2-maintained strategic ports, military bases, and nuclear-facility inventories.
- Configured public CCTV network assets.
- Eight YouTube live-news channels used by the desktop media panel.
Reference overlays can age independently of runtime feed health. Validate important facility, route, ownership, and status details against the relevant primary source before operational use.
Normalization and retention
Check the circuit
A scheduled adapter first asks whether its source circuit allows a request.
Fetch and normalize
Source-specific code maps provider fields to typed observations or specialized tracking, market, vulnerability, and FININT rows. Primary adapters attach their registered data-source ID and provenance tier when available.
Resolve context
Where supported, Y2 resolves places, entities, incidents, market subjects, and evidence links. Resolution failure can be non-fatal, leaving the source observation available without every ontology link.
Upsert deterministically
Event-cache rows use the (sourceType, sourceId) identity. Duplicate items within a batch
collapse with the last value winning; existing rows are updated rather than blindly appended.
Publish reactively
Convex queries update monitor markers, cards, panels, and app tools when stored data changes.
Transient osintDataCache observations normally receive a seven-day expiry. Evidence-bearing Y2
report, discovery, and expansion observations are excluded from the transient cleanup set.
Specialized tables have independent retention—for example, GPS and aircraft rows use 30 minutes,
vessels use 24 hours, and the country stock-index cache uses one hour.
Interpret circuit-breaker state
| State | Meaning in the current UI |
|---|---|
| Pending | No circuit-breaker row exists for that source type; often means it has never recorded a fetch result |
| Closed | Requests are allowed. The card can still show 1–4 accumulated failures before the threshold opens the circuit |
| Open | Five or more consecutive failures have opened the circuit; requests are skipped until the five-minute cooldown expires |
| Half open | A probe state recognized by the schema and UI; the next successful result closes it and a failed probe reopens it |
After cooldown, an open source is allowed to attempt another request. A success resets the failure count and last error; another failure keeps the circuit open.
Source health describes adapter execution, not truthfulness, completeness, or corroboration of the underlying data. Always retain the source URL and provenance when making a consequential assessment.
Next steps
Use the Situation Room
Relate each source class to its current map or analysis surface.
Understand data infrastructure
Follow identity, ontology, evidence, and API representations after ingestion.
Review country cards
See how source records combine at country level.
Use OSINT APIs
Query supported public representations with scoped credentials.