# Warsat — OSINT Military/Intelligence Scanner

## Overview

Warsat is an on-demand intelligence scanner that monitors military movements, geopolitical developments, and conflict indicators across six domains:

- **AIR** — Aircraft, bombers, ISR assets
- **SEA** — Naval movements, shipping, carrier groups
- **LAND** — Ground forces, armor, troop movements
- **CYBER** — Information operations, internet blackouts, economic warfare
- **PROXY** — Non-state actors, militias, Hezbollah, Houthis
- **INFRASTRUCTURE** — Nuclear sites, energy facilities, diplomatic developments

## Usage

### On-Demand Scan
Say **"warsat scan"** to run all categories, or **"warsat scan [category]"** for a specific domain:
- `warsat scan air`
- `warsat scan sea`
- `warsat scan land`
- `warsat scan cyber`
- `warsat scan proxy`
- `warsat scan infra`

### Output Format
Each scan produces a structured report with:
- Alert level (CRITICAL/HIGH/MEDIUM/LOW)
- Key findings
- Source citations
- Comparison to previous scan

## Change Detection System

### How It Works
Every Warsat scan is saved to `memory/warsat/history/YYYY-MM-DD-HHMM.md`. On each new scan, the system:

1. Loads the previous scan from history
2. Compares findings by category
3. Highlights changes:
   - **🆕 NEW** — developments that weren't there before
   - **🔺 ESCALATED** — things that got worse
   - **🔻 DE-ESCALATED** — things that improved
   - **⏸️ STATUS QUO** — unchanged

### History Retention
ALL scan history is retained in `memory/warsat/history/`. Storage is cheap; patterns are valuable. If space becomes a concern, we can implement archival rules later.

### Reading History
To review past scans:
```
memory/warsat/history/
├── 2026-04-09-1724-scan.md
├── 2026-04-09-1900-scan.md
└── ...
```

Each file contains the full scan report with timestamp.

## Monitor Definitions

Monitors are defined in `memory/warsat/monitors.json` with 50 monitors across 6 categories plus 5 direct-fetch sources.

Each monitor includes:
- `category` — domain (air, sea, land, cyber, proxy, infra)
- `target` — what to search for
- `query` — search string
- `sources` — where to look
- `alertLevel` — threshold for escalation

## Automated Intel Reports

Warsat runs automatically for scheduled intel briefings. Configure via cron jobs in OpenClaw.

## Files

| File | Purpose |
|------|---------|
| `monitors.json` | Monitor definitions (50 monitors) |
| `README.md` | This documentation |
| `history/` | Scan history archive |

## Current Focus: Iran Conflict (April 2026)

Warsat is currently configured for:
- Iran nuclear facilities (Natanz, Fordow, Bushehr)
- B-52/B-1/B-2 bomber movements from RAF Fairford
- Carrier strike groups (Lincoln, Bush)
- Hezbollah/Lebanon situation
- Hormuz Strait shipping traffic
- Iranian internet blackout
- Oil prices and economic indicators

---

*Last updated: 2026-04-09*