The Q field has had the right signal for a while.
It already knew:
- which entities were spiking
- which requester IPs were contributing to those spikes
- which observers looked human
- where those observers appeared to sit in the world
But until now, you still had to imagine the field.
You could read tables.
You could inspect cards.
You could move between Observers and Observed.
What you could not do was inhabit the scene.
That changes now inside Luna.
We built a new Q Field Explorer:
- a live 3D geospatial globe
- human cyber clusters sitting close to the surface
- spiking observed entities lifted above their approximate footprint
- arc lines connecting the observers to the entities they are converging on
The result is a much more faithful operational picture of what the Q field actually is:
not only a score surface, but a living geography of attention.
1. Human analysts are a geographic structure
The Q field is not just “activity.”
It has shape.
When we type observers in the live field, some requester IPs look meaningfully human:
- focused investigators
- analyst-like observers
Those human observers are not distributed evenly.
They gather inside real cyber estates:
- cloud-heavy city clusters
- shared network organizations
- operational geographies where analysts are working in parallel
The new explorer turns that into a visible layer.
Observer IPs stay close to the globe because they are the surface activity. They are the analysts, the requesters, the people or near-human actors doing the work.
Clusters emerge where those observers pile up.
2. Observed entities should not sit on the same depth plane
The entity that is being watched is not the same thing as the person doing the watching.
So we stopped drawing them as if they were.
In the explorer:
- observer IPs and human cluster markers stay lower, close to the earth
- observed entities rise above the globe
- stronger spikes rise farther
That altitude difference matters.
It makes the scene legible in one glance:
- who is near the ground and contributing attention
- what is being lifted by communal demand
- where the field is intensifying fastest
This is especially important in dense cluster regions.
Without altitude, the field collapses into overplotted geography. With altitude, the causal structure becomes visible.
3. The arcs are the real story
The most important mark in the scene is not the pin.
It is the arc.
Each arc says:
- this observer
- from this geography
- is part of the current attention flowing into that entity
That means the explorer is not only a map of where things are.
It is a map of who is converging on what.
This is where the Observers and Observed views finally meet.
Before:
- the observer side showed population structure
- the observed side showed entity spikes
Now:
- the globe binds them into the same scene
That makes it much easier to answer operational questions like:
- Which cities currently contain the strongest human analyst concentration?
- Which observed entities are being validated by multiple human geographies?
- Is a spike local, regional, or globally distributed?
- Are we seeing a shared cyber cluster or isolated single-estate behavior?
4. Clickable spatial context matters in operations
This is not a decorative globe.
The scene is interactive.
You can rotate, zoom, and click on:
- a human cluster
- an observer pin
- a spiking observed entity
The rail then loads the relevant context:
- observer type
- entity type
- location label
- live counts
- top linked observers
- linked entities
- direct report links
So the scene keeps the dramatic spatial overview, but it still resolves back into usable investigative detail.
That is the important product line for Luna:
beautiful enough to think with, precise enough to operate with.
5. Why this matters for Syndu
The deeper reason for this release is product maturity.
Syndu is no longer only assembling telemetry. It is building operational representations.
The Q field already helped us identify:
- analyst convergence
- communal validation
- cyber cluster squeeze
- flash-crowd behavior
- the difference between human and programmatic observation
The explorer makes those structures spatially intuitive.
It turns the Q field from a dashboard you read into a field you can navigate.
And that matters because modern cyber investigation is not only about retrieving facts.
It is about understanding:
- where the work is happening
- how it is clustering
- which entities are pulling collective attention
- and how those two layers interact in real time
That is exactly what the new Q Field Explorer is built to show.
