Dedicated case selector
CommandDeck is its own workspace, not a panel inside a case file. Pick any investigation from the case selector and it loads straight into the deck; switch cases without losing your place.
analyst workspace
CommandDeck
CommandDeck is Command One's dedicated analyst workspace. Open a case file and the whole investigation becomes a working relationship graph you can move around, filter and annotate — then leave it exactly as you found it, because your layout, zoom and filters are saved and restored next time you sign in.
It is a layer over the evidence, never a tool that edits it. Scan findings stay immutable and fully attributed to the module that produced them; your notes, flags, tags, manual links and attachments sit alongside them so reasoning and raw evidence are never confused with one another.
public and licensed sources only · free registration · Google sign-in never reads your Gmail, Drive or contacts
live platform
46
enabled modules
36
enabled fleet modules
1
workers online
51,096
source checks completed
14,394
findings normalised
what makes it different
A workspace, not a picture of your results
Pan, zoom and drag
Move around the graph freely, zoom into a dense cluster, and drag the target, hubs or individual findings until the picture reads the way you think about it.
Search, filter and confidence views
Search the graph, narrow it by category or module, and view it by confidence band so single-source leads never look like corroborated facts.
Collapsible clusters
Fold a noisy hub down to a single node and open it again when you need the detail — large cases stay legible instead of turning into a hairball.
Source provenance & confidence
Every node keeps the module that produced it, its raw payload, its timestamp and its confidence score, so anything you carry into a report can be re-verified by someone else.
Analyst notes, flags and tags
Write your reasoning where the evidence is: notes on a node, flags for what needs checking, tags for the themes you are tracking. All of it is yours and private to your account.
Manual links, visually distinct
Draw the connection you believe exists. Analyst-created links render differently from collected evidence links, so a hypothesis can never be mistaken for a machine-observed relationship.
Private evidence attachments
Attach screenshots and documents to a case in private storage, retrievable only through your account — the corroboration that never came from a scan still lives beside the scan.
Saved workspace state
Layout, zoom, and the filters you were using are saved per case and restored when you return — on the same machine or a different one.
Web Intelligence relationships
With the Web Intelligence modules enabled — Wayback CDX, urlscan.io and VirusTotal — the deck also draws infrastructure chains: domain → IP → ASN → certificate or related domain → archived URL.
how analysts use it
From raw findings to a defensible picture
Select the case
Choose the investigation from the case selector; CommandDeck loads its findings, entities and relationships.
Shape the view
Filter by confidence, module or category, collapse the clusters you are not working, and arrange what remains.
Record your thinking
Add notes, flags and tags, draw the manual links you believe hold, and attach the private evidence behind them.
Come back to it
Your layout, zoom and filters persist per case across sessions and devices, so a long investigation stays continuous.
Open CommandDeck on your first case
Registration is free and comes with a daily credit allowance. Run a sweep or a recon pipeline, then open CommandDeck on the case file it produces.