™Explore Hawkeye
+THE HAWKEYE USE CASE LIBRARY

Different missions.
One private foundation.

Twenty ways to bring your data, security, and intelligence together. Explore how on-box AI agents, SIEM, and analytics can support work inside your own environment.

Explore the use casesBuild an application
BUILT AROUND YOUR MISSION
20EXAMPLE
USE CASES
Public safety
Security operations
Legal & governance
Critical infrastructure
Research & defense
5 MISSION DOMAINSONE PRIVATE FOUNDATION

Illustrative use cases and reference architectures. Connect approved data sources, configure access and workflows, and validate the deployment for your organization.

YOUR DATA. YOUR BOUNDARY.
FEATURED USE CASE · DEVELOPERS

The data lake
for your application.

Build a private, multi-tenant application on Hawkeye's data lake and PostgreSQL database. Use ETL / ELT pipelines to organize incoming data, search structured and unstructured information, and bring local AI into your own application.

Example: a case review app for multiple agencies. Each agency has its own tenant boundary. Your app retrieves authorized records and source documents, requests an on-box model summary, and saves reviewed results through Hawkeye's data services. Add an examiner review queue for supported EWF (.E01) image exports, verification reports, and custody records. Your interface and business logic stay in your separate codebase. For bare-metal installations, deploy the application directly on-box in an isolated virtual machine on the Hawkeye Hypervisor.

Explore your application foundation
YOUR APPLICATIONSeparate codebase · your workflows · your user experience
Scoped APIs + MCP Server
PRIVATE HAWKEYE FOUNDATION
Data lake + PostgreSQLETL / ELT · structured & unstructured search
Multi-tenant operationsContainer or server isolation · migration · disaster recovery
Active-active or active-passive data replication
On-box GPU + model servicesGPU control, isolation & forensics · local LLM library
Build custom LLMs to run on-box
Verifiable evidence exportEWF (.E01) image sets · integrity manifests
Chain of custody · examiner-approved release
On-box AI agents · security / SIEM · analytics
00
Hawkeye Hypervisor™Layer 0 · bare-metal foundation

Deploy your application directly on-box in an isolated virtual machine alongside Hawkeye services.

ILLUSTRATIVE DEVELOPER REFERENCE ARCHITECTURE
.E01
DIGITAL FORENSIC EVIDENCE WORKFLOWS

Verifiable exports.
Prepared for court review.

Export supported forensic images in Expert Witness Format (EWF), starting with .E01, alongside verification results, a hash manifest, and chain-of-custody records. Explore the evidence workflows in the use cases below.

Explore EWF evidence export
20of 20 use cases
01

Law enforcement

Public safety

Bring the case into focus.

Bring incident records, statements, and associated media into a private case workspace. An on-box agent can help an authorized investigator navigate the material and prepare a source-linked draft, while local analytics organize events across the case.

On-box AI agentsAssist with case summaries and document retrieval.
On-box analyticsExplore event timelines and record relationships.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportPrepare supported acquired disk or volume images as .E01 evidence sets for investigator and examiner review. Include hashes, custody history, and acquisition records; keep body-camera video and statements in their native formats as companion evidence.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Investigators verify findings against original material before use; case permissions define the scope.

REFERENCE ARCHITECTUREILLUSTRATIVE
CAD & RMS recordsStatements & case filesBody / in-car media
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTNormalize incident records · Link material to its source
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Case chronology
Investigator review brief
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Case review applicationDeveloper-built application · separate codebase
Agency data center or investigation workstationExplore deployment options
02

Hospital security

Security operations

Connect the security picture across a care campus.

Organize security reports, door-access events, and authorized video references by facility and incident. On-box agents help teams retrieve response procedures and prepare shift summaries; local analytics highlight event patterns across buildings and time periods.

On-box AI agentsRetrieve security procedures and draft incident handovers.
On-box analyticsCompare incident volumes by location and shift.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportFor an authorized security investigation, export supported acquired endpoint images as .E01 with verification and custody records. Keep access logs and video as native companion files, scoped to the incident and approved recipients.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Security staff review every output. Scope the workspace to authorized security records and minimize patient information.

REFERENCE ARCHITECTUREILLUSTRATIVE
Security incident reportsAuthorized access logsVideo references & SOPs
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTAlign facility and event IDs · Separate security workspaces
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Shift handover brief
Facility incident timeline
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Hospital security operations appDeveloper-built application · separate codebase
Hospital-controlled private infrastructureExplore deployment options
03

Private security

Security operations

One operational foundation. Separate client boundaries.

Unify patrol reports, dispatch records, and site procedures without mixing client workspaces. On-box agents can assemble site-specific handovers, while analytics help supervisors review patrol activity and unresolved incidents across authorized locations.

On-box AI agentsPrepare handovers using only the assigned client's information.
On-box analyticsReview patrol completion and incident trends by site.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportPrepare client-authorized forensic image exports in .E01, with an integrity manifest and documented handoff. Keep each client’s evidence, native incident files, and release permissions within its tenant boundary.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Supervisors validate reports and control what is shared with each client; access stays tenant-scoped.

REFERENCE ARCHITECTUREILLUSTRATIVE
Guard patrol reportsDispatch & incident logsClient site procedures
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTPartition records by client · Normalize site and shift data
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Client-scoped activity brief
Supervisor incident queue
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Client security management appDeveloper-built application · separate codebase
Private operations center or site workstationExplore deployment options
04

Law firms

Legal & governance

Keep matter intelligence inside the firm.

Organize documents, correspondence, and discovery material within separate matter workspaces. An on-box agent can help retrieve relevant material and draft factual summaries from the firm's sources, while analytics reveal document and event relationships for attorney review.

On-box AI agentsAssist with document questions and factual drafting.
On-box analyticsExplore document sets, dates, and matter activity.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportReceive, preserve, verify, and release supported .E01 image sets for discovery and expert review. Maintain matter-specific custody records and native documents; counsel and the examiner determine the appropriate production scope.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Attorneys validate outputs and maintain matter-access boundaries and the firm's confidentiality procedures.

REFERENCE ARCHITECTUREILLUSTRATIVE
Matter documentsCorrespondence exportsDiscovery & exhibits
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTOrganize by matter and source · Normalize dates and metadata
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Source-linked matter digest
Document chronology
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Private matter research appDeveloper-built application · separate codebase
Firm-controlled servers or private workstationsExplore deployment options
05

Nuclear facilities

Critical infrastructure

Review sensitive facility records within a controlled boundary.

Use approved, read-only copies of maintenance records, procedures, and security events in an isolated review environment. On-box agents assist with document retrieval and review packages; analytics help teams examine record history without issuing commands to plant systems.

On-box AI agentsRetrieve approved procedures and summarize record changes.
On-box analyticsReview historical maintenance and security event patterns.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportExport supported, previously acquired forensic images as .E01 from the approved analysis environment. Attach validation and custody records for facility incident review, without connecting the export workflow to plant control or safety systems.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Facility specialists approve use and review outputs. Keep the reference environment separate from plant control and safety systems.

REFERENCE ARCHITECTUREILLUSTRATIVE
Approved maintenance exportsControlled procedure copiesSecurity event exports
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTValidate approved data intake · Link records and revisions
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Maintenance review package
Procedure change summary
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Controlled records review appDeveloper-built application · separate codebase
Isolated, facility-approved analysis environmentExplore deployment options
06

Emergency management

Public safety

Build a common picture when connectivity is limited.

Organize situation reports, resource status updates, and response plans within an emergency operations workspace. On-box agents can draft briefings from the latest approved information, while analytics make changes in needs, resources, and incident status easier to review.

On-box AI agentsAssemble briefings grounded in approved updates and plans.
On-box analyticsTrack resource status and changes across reporting periods.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Incident command verifies timeliness and approves briefings; resource and response decisions remain with authorized personnel.

REFERENCE ARCHITECTUREILLUSTRATIVE
Situation reportsResource status exportsResponse plans & logs
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTNormalize incident updates · Retain time and source context
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Situation briefing draft
Resource status overview
APIs + MCP Server · scoped access
Offline coordination dashboardDeveloper-built application · separate codebase
Emergency operations center or field workstationExplore deployment options
07

Fire & rescue

Public safety

Turn operational records into reviewable lessons.

Bring incident reports, dispatch timelines, and pre-incident plans into a private operational workspace. On-box agents can help assemble after-action drafts and retrieve plan information, while analytics organize response history for training and operational review.

On-box AI agentsRetrieve pre-incident information and assist after-action drafting.
On-box analyticsCompare response intervals and incident categories.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Officers verify records and approve lessons learned. The workflow supports review rather than directing emergency operations.

REFERENCE ARCHITECTUREILLUSTRATIVE
Incident reportsDispatch timeline exportsPre-incident plans
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTAlign incident and unit IDs · Organize plans and chronology
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
After-action draft
Response history dashboard
APIs + MCP Server · scoped access
Fire operations review appDeveloper-built application · separate codebase
Department servers or a mobile command workstationExplore deployment options
08

911 communications centers

Public safety

Make incident reconstruction easier to follow.

Organize CAD event exports, authorized call transcripts, and dispatch procedures within a communications-center workspace. On-box agents help prepare incident reconstructions and handovers; analytics expose gaps in the records for a supervisor to investigate.

On-box AI agentsAssemble source-linked event summaries for supervisors.
On-box analyticsReview recorded call and dispatch intervals.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportWhere an investigation includes an authorized forensic image, export it as a verified .E01 set. Preserve call recordings and CAD exports in their native formats with source timestamps, hashes, and documented custody for incident reconstruction.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Supervisors verify transcript accuracy and context. Any quality finding requires human review of the underlying material.

REFERENCE ARCHITECTUREILLUSTRATIVE
CAD event exportsAuthorized call transcriptsDispatch procedures
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTAlign timestamps and event IDs · Link transcript references
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Incident reconstruction
Quality review packet
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Dispatch quality review appDeveloper-built application · separate codebase
Communications-center private infrastructureExplore deployment options
09

Corrections

Public safety

Preserve continuity across facility shifts.

Bring shift logs, facility incidents, and approved procedures into an access-controlled workspace. On-box agents assist with handover drafts and procedure retrieval, while analytics help staff review recurring operational issues across locations and reporting periods.

On-box AI agentsSummarize unresolved operational items for the next shift.
On-box analyticsReview aggregate incident categories and recurring facility issues.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportPrepare supported forensic image exports in .E01 for authorized facility investigations. Include verification and custody history, with original video and incident logs retained as separately identified companion evidence.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Authorized staff verify handovers. This pattern does not automate individual risk scoring, discipline, or custody decisions.

REFERENCE ARCHITECTUREILLUSTRATIVE
Shift logsFacility incident recordsApproved procedures
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTNormalize locations and shifts · Separate restricted records
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Shift continuity brief
Operational issue summary
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Facility continuity applicationDeveloper-built application · separate codebase
Facility-controlled private or offline infrastructureExplore deployment options
10

Courts & prosecutors

Legal & governance

Organize the record without losing its origin.

Bring authorized filings, exhibit indexes, and case administration records together in separate workspaces. On-box agents help prepare factual record digests, while analytics track document versions and case-material completeness for a reviewer.

On-box AI agentsRetrieve documents and prepare factual, source-linked summaries.
On-box analyticsReview missing materials, versions, and processing history.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportReview complete .E01 image sets with validation reports, acquisition notes, and documented custody. Prepare examiner-reviewed evidence packages for court presentation while keeping factual source material distinct from AI-assisted summaries.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Authorized legal personnel verify the record. Judicial and prosecutorial decisions remain human responsibilities.

REFERENCE ARCHITECTUREILLUSTRATIVE
Authorized filingsExhibit indexesCase administration records
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTLink filings to source records · Organize versions and dates
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Record review digest
Case-material checklist
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Legal record review workspaceDeveloper-built application · separate codebase
Court or prosecutor-controlled infrastructureExplore deployment options
11

Government oversight & audit

Legal & governance

Build review packages from traceable source records.

Organize agency policies, administrative records, and audit evidence inside a scoped review workspace. On-box agents help auditors locate supporting material and draft observations, while analytics organize evidence status and activity across the review.

On-box AI agentsRetrieve policy and evidence references for an auditor.
On-box analyticsTrack evidence completeness and review progress.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportExport supported forensic images as .E01 for authorized audits and investigations. Pair each set with integrity checks, an evidence inventory, and custody records so reviewers can trace the source and handoff.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Auditors validate all observations and conclusions; the configuration must follow the agency's authorized scope and handling rules.

REFERENCE ARCHITECTUREILLUSTRATIVE
Agency policy documentsAdministrative record exportsAudit evidence packages
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTTag evidence to review topics · Preserve origin and revisions
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Evidence index
Draft audit observations
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Evidence-backed audit applicationDeveloper-built application · separate codebase
Agency private network or isolated audit workspaceExplore deployment options
12

Defense & government contractors

Research & defense

Keep program knowledge within its approved boundary.

Organize authorized engineering records, program procedures, and issue histories in separate program workspaces. On-box agents can assist with document retrieval and technical handovers; analytics help teams review changes and unresolved work using locally held information.

On-box AI agentsRetrieve program-specific procedures and document context.
On-box analyticsReview change history and unresolved issue trends.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportPrepare verified .E01 exports of supported acquired images for authorized incident response and investigations. Apply classification, tenant, and release restrictions to the image set and its companion custody records.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Program owners approve data scope and deployment. This pattern does not establish authorization to process classified information.

REFERENCE ARCHITECTUREILLUSTRATIVE
Authorized engineering recordsProgram proceduresIssue & change histories
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTSeparate program workspaces · Link changes and source records
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Technical handover draft
Program change overview
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Program knowledge applicationDeveloper-built application · separate codebase
Program-approved private or disconnected environmentExplore deployment options
13

Electric utilities

Critical infrastructure

Connect outage and maintenance history for review.

Bring approved outage, work-order, and equipment-record exports into a private analysis workspace. On-box agents can prepare historical incident summaries and retrieve maintenance context, while analytics help engineers examine recurring issues by asset and service area.

On-box AI agentsSummarize prior work and retrieve equipment documentation.
On-box analyticsExplore historical events and maintenance frequency by asset.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Engineers validate conclusions. Use approved read-only data paths; this reference pattern does not operate grid controls.

REFERENCE ARCHITECTUREILLUSTRATIVE
Outage record exportsMaintenance work ordersEquipment documentation
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTNormalize asset identifiers · Connect work and event history
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Asset history review
Outage review summary
APIs + MCP Server · scoped access
Utility asset review applicationDeveloper-built application · separate codebase
Utility-controlled analysis networkExplore deployment options
14

Water & wastewater

Critical infrastructure

Make facility records easier to review together.

Organize approved inspection reports, maintenance exports, and laboratory result records in a facility-scoped workspace. On-box agents assist with record retrieval and review packets, while analytics help specialists examine historical results and recurring maintenance issues.

On-box AI agentsPrepare source-linked summaries for facility reviewers.
On-box analyticsExplore historical result and maintenance patterns.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Qualified staff interpret results and make operational decisions. The analysis environment remains separate from treatment controls.

REFERENCE ARCHITECTUREILLUSTRATIVE
Inspection reportsMaintenance record exportsApproved lab result records
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTAlign facility and asset IDs · Retain result and source context
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Facility review packet
Historical records dashboard
APIs + MCP Server · scoped access
Water facility records applicationDeveloper-built application · separate codebase
Facility private infrastructure or offline workstationExplore deployment options
15

Oil & gas facilities

Critical infrastructure

Bring site history into a private review workspace.

Connect approved inspection, maintenance, and incident-report exports for a facility or project. On-box agents can assemble shift and inspection summaries from local records, while analytics help teams examine maintenance backlog and recurring documented issues.

On-box AI agentsRetrieve approved procedures and draft record-based handovers.
On-box analyticsReview documented issues and work-order status over time.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Site specialists verify outputs. Use read-only exports and keep the application separate from process and safety controls.

REFERENCE ARCHITECTUREILLUSTRATIVE
Inspection & maintenance exportsSite incident reportsApproved operating procedures
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTNormalize site and asset records · Link issues to source material
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Inspection review brief
Maintenance history view
APIs + MCP Server · scoped access
Site knowledge and review appDeveloper-built application · separate codebase
Site-controlled servers or disconnected field workstationExplore deployment options
16

Airports & aviation security

Security operations

Connect security events across a complex facility.

Bring authorized access-event exports, security reports, and response plans into a private airport workspace. On-box agents assist with incident summaries and handovers; analytics help supervisors review events by terminal, location, and time.

On-box AI agentsRetrieve response procedures and summarize documented incidents.
On-box analyticsReview incident patterns across facility areas.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportFor authorized airport security investigations, export supported acquired images as .E01 with validation and custody documentation. Keep surveillance and access-event exports in native formats and separate the review environment from operational control systems.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Security staff review the underlying records and approve responses. The pattern does not control aviation or access systems.

REFERENCE ARCHITECTUREILLUSTRATIVE
Authorized access-event exportsSecurity incident reportsFacility response plans
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTAlign locations and timestamps · Link related incident records
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Security shift brief
Facility event timeline
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Airport security review appDeveloper-built application · separate codebase
Airport-controlled private security networkExplore deployment options
17

Ports & maritime

Security operations

Turn terminal records into a coherent operational picture.

Organize authorized gate-event exports, incident reports, and terminal procedures in site-specific workspaces. On-box agents help prepare shift summaries and retrieve procedures, while analytics connect documented events across terminal locations and reporting periods.

On-box AI agentsAssemble handover briefs from approved terminal information.
On-box analyticsReview historical event volumes by terminal and shift.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Authorized staff verify records and determine responses. The analysis workflow does not operate vessel or cargo-control systems.

REFERENCE ARCHITECTUREILLUSTRATIVE
Gate-event exportsTerminal incident reportsSite operating procedures
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTNormalize terminal identifiers · Link event and shift records
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Terminal shift summary
Documented event overview
APIs + MCP Server · scoped access
Terminal operations knowledge appDeveloper-built application · separate codebase
Port operations center or local terminal serversExplore deployment options
18

Manufacturing & industrial operations

Critical infrastructure

Connect quality, maintenance, and engineering knowledge.

Bring approved quality reports, work-order histories, and engineering procedures into a private plant workspace. On-box agents assist with troubleshooting research and handover drafts, while analytics help specialists review recurring documented defects and maintenance patterns.

On-box AI agentsRetrieve approved technical material and summarize related records.
On-box analyticsReview defect categories and maintenance trends.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Engineers validate findings and authorize changes. Keep the reference application separate from production machine controls.

REFERENCE ARCHITECTUREILLUSTRATIVE
Quality report exportsMaintenance historiesEngineering procedures
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTAlign product and asset IDs · Preserve revisions and sources
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Quality review packet
Maintenance pattern summary
APIs + MCP Server · scoped access
Industrial knowledge applicationDeveloper-built application · separate codebase
Plant-controlled infrastructure or local engineering workstationExplore deployment options
19

Financial services

Legal & governance

Give reviewers a private, traceable evidence workspace.

Organize authorized investigation records, internal policies, and audit evidence within scoped workspaces. On-box agents assist with evidence retrieval and factual review drafts, while analytics help teams understand case-material completeness and review progress.

On-box AI agentsRetrieve policy references and summarize supplied records.
On-box analyticsTrack evidence completeness and case-review activity.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
EWF (.E01) evidence exportSupport fraud, insider-threat, and incident investigations with verified .E01 exports of supported acquired images. Preserve native transaction records separately, with case-scoped access, retention, and a documented evidence handoff.Explore the verification workflow
REVIEW & OPERATING BOUNDARY

Qualified reviewers verify conclusions and determine actions. This pattern does not automate credit, account, or eligibility decisions.

REFERENCE ARCHITECTUREILLUSTRATIVE
Authorized investigation recordsInternal policy documentsAudit evidence exports
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTScope records by review · Normalize evidence metadata
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Reviewer evidence brief
Review progress overview
EWF (.E01) evidence exportFrom preserved source images · all segments
Separate from AI outputs
Verification + custody records · examiner review
APIs + MCP Server · scoped access
Financial review workspaceDeveloper-built application · separate codebase
Firm-approved private or isolated environmentExplore deployment options
20

Research labs & universities

Research & defense

Keep research knowledge close to the people building it.

Organize approved experiment records, technical documents, and project datasets in separate research workspaces. On-box agents help teams retrieve methods and prepare project handovers, while analytics organize dataset metadata and documented results for specialist review.

On-box AI agentsRetrieve approved methods and draft source-linked handovers.
On-box analyticsExplore dataset metadata and documented project results.
On-box security & SIEMMonitor platform, endpoint, and access activity inside the deployment.
REVIEW & OPERATING BOUNDARY

Researchers validate interpretations and enforce project access rules; sensitive research stays within its approved scope.

REFERENCE ARCHITECTUREILLUSTRATIVE
Approved experiment recordsTechnical documentsProject dataset metadata
Authorized ingestion
PRIVATE HAWKEYE ENVIRONMENT
Private data lake + databasesTenant-scoped records · preserved sources
ETL / ELTPartition by research project · Link methods and record versions
AI agentsSecurity / SIEMAnalytics
ALL ON-BOX · LOCAL MODELS + GPU COMPUTE
REVIEWABLE OUTPUTS
Project knowledge digest
Dataset and results overview
APIs + MCP Server · scoped access
Private research knowledge appDeveloper-built application · separate codebase
Lab servers, GPU workstations, or offline research environmentExplore deployment options
FROM REFERENCE PATTERN TO YOUR APPLICATION

Your workflow.
Your private foundation.

Start with a scenario. Shape the data flow around your procedures.
Keep your application independent through APIs and MCP.

Explore your application foundationBack to the use case library