Methodology and limitations

Purpose and audience

HECAVEX Labs publishes small browser-based workspaces and deliberately public datasets for threat-intelligence analysts, defenders, investigators, journalists and researchers. It is maintained by Deividas Lis / HECAVEX on a best-effort basis without continuous monitoring, operational response or an SLA.

Publication gate

A workspace must have a defined analytical task, public-source provenance, a stable data boundary and an explanation of what its output does not prove. Private submissions, credentials, malware samples, victim data, quarantined observations and unpublished analyst notes do not belong in this repository.

Evidence classes

Observation

A directly captured or source-reported fact with time and provenance.

Derivation

A reproducible transformation such as normalization, hashing, filtering or counting.

Assessment

An analyst interpretation that states confidence, competing explanations and limits.

Reference

Third-party framework or catalogue material that remains attributable to its authoritative publisher.

These classes are related to, but not interchangeable with, APT Notes confidence or Radar candidate and maliciousness states.

Sources and attribution

Primary and authoritative sources are preferred. A source's own language, date and attribution confidence are preserved. Infrastructure overlap, ATT&CK reference data, a shared tool or a similar page does not independently establish common control or actor identity.

Transformations and reproducibility

Generated counts and relationships must identify their input, version and transformation. A case graph keeps observations, derivations, assessments and limitations separate. Browser-local workspaces do not silently upload analyst input; exports remain under the user's control.

Freshness and maintenance

Each catalogue entry exposes an update or review date. Generated ATT&CK material is refreshed against a named upstream version. Curated material is reviewed when its source changes, a correction arrives or the related HECAVEX research is updated. “Maintained” means active best-effort stewardship, not real-time completeness.

Licensing boundary

HECAVEX-authored software is MIT licensed. Original curated text and data are CC BY 4.0 only where the data terms identify them as covered. MITRE ATT&CK, linked sources, trademarks and other third-party material retain their own terms. See the data catalogue, human-readable licensing boundary and repository data notice before reuse.

Limitations

Public reporting is incomplete and uneven. The Atlas is selected rather than exhaustive; pivot cases are time-bounded; ATT&CK mappings require procedure-level confirmation; detection packages are engineering candidates rather than deployable rules; and the OSINT directory cannot guarantee provider availability or terms. Labs is not a blocklist, attribution authority, SOC, scanner or incident-response platform.

Corrections and security

Corrections should identify the page, record and supporting evidence and can be sent through the HECAVEX contact channel. Report website vulnerabilities or accidental publication through the Labs security policy.