Proof and honest limits
Show the chain, not a connector logo wall.
The delivery chain HIIH demonstrates is: a controlled hostile interaction, an Observation, a structured Finding with a preserved finding_id, an MCP or API pull, and an analyst retrieving related context. HIIH delivers on the pull paths — Console, MCP and API, with STIX 2.1 over TAXII 2.1 available by engagement. The Access Finding family is inspectable in the Console today, and a first deployment confirms the full path with a controlled event.
OHIIHO Research provides evidence that HIIH environments produce meaningful observations and analysis; the delivery model demonstrates that a structured operational result can move into a workflow. These are complementary forms of evidence. HIIH does not decorate this page with unsupported partner logos, certification implications, roadmap-only integrations or staged dashboards.
Current delivery scope.
| What HIIH delivers today | What it does not promise |
|---|---|
| The Surface Console | One compiler for every output format |
| STIX 2.1 over TAXII 2.1, by engagement | Identical fields across every output |
| An MCP path and an API for authorized tools | Certified integration with every SIEM |
| One Finding identity across the pull paths | A write path into your environment |
| The Access Finding family, inspectable in the Console | A universal MISP / CERT feed |
| Additional forms shaped per engagement | Cryptographically sealed delivery |