# Air-gapped network analysis: searching classified selectors with zero footprint > How analysing open-system network data inside an air-gapped environment lets you search classified selectors without a single query leaving the building. --- LLMS index: [llms.txt](/llms.txt) --- **In short:** intelligence and defence teams hold selectors they cannot disclose: IP addresses, domains and fingerprints drawn from classified reporting. Looking one up in an outside service tells that service, and anyone who can see the request, what you are interested in. The answer is to reverse the direction: bring network traffic data from open systems into the air-gapped environment and search it there. No query leaves the building, so the analysis leaves no operational footprint. ## What is a selector? A selector is anything that identifies a target in data: an IP address, a domain, a URL, a JA4+ fingerprint, a hash, an email address. On the high side, many selectors are classified because of what they reveal: which infrastructure an agency knows about, which operation it is following, and where that knowledge came from. ## Why is a query a disclosure? A lookup travels. It crosses networks you do not control and is recorded in someone else's logs, with the selector, the time and often the organisation that asked. The provider now holds a fragment of your intelligence picture. An adversary who controls that infrastructure, watches it, or simply notices that its own addresses are being searched, learns that it has been seen. Teams work around this in three ways, and each has a cost: - **Query anyway,** and accept the leak. - **Search from an unattributable system,** which hides the requester but still discloses the selector. - **Do not search,** and leave the classified holdings unconnected to what is happening on the open internet. ## Bring the data to the selectors Classified selectors live on the high side. The network data that gives them meaning lives outside: traffic crossing the internet, context on the addresses involved, activity inside the networks adversaries route through. Zero-footprint analysis moves that data across the boundary, not the questions. 1. Network data from open systems is exported in bulk. 2. It crosses into the air-gapped environment through the approved transfer, in one direction. 3. It is loaded into an analysis platform that runs entirely inside the boundary. 4. Analysts search classified selectors against it, and combine the results with classified holdings, without a single request leaving the building. The selectors never touch an outside system. Nothing about the search is visible from outside: not the selector, not the time, not the fact that anyone looked. ## Which open-system data is worth bringing in? - **Traffic beyond your own perimeter.** Flows observed inside covert networks (Tor, residential proxies, commercial VPNs and [ORB networks](/guides/orb-networks/)) show adversary infrastructure in use, including activity that never reaches your own sensors. - **Context on every address.** Geolocation, network ownership, and VPN, Tor and residential proxy attribution turn a bare IP address into something an analyst can reason about. - **Fingerprints.** [JA4+ fingerprints](/guides/ja4-fingerprints-explained/) identify the software behind encrypted sessions, so a selector can be a tool as well as an address. - **Telemetry from your own internet-facing systems.** Connection, DNS, HTTP and TLS records from the open networks you operate. ## What does zero-footprint analysis require? 1. **A self-contained platform.** No call-home, licence check or external dependency at installation or run time. 2. **Data delivered in bulk.** Complete exports that can cross a one-way transfer, not an API that expects a live connection. 3. **Search at volume, on site.** Months of flows, searchable fast enough that analysts use it, with pivots on every selector type they hold. 4. **Verified, versioned imports.** Integrity checked before loading, complete sets so every system knows what it holds, and the previous set kept for rollback. 5. **A record inside the boundary.** Who searched for what, and when, stays on the high side with everything else. ## How current is the data? As current as the last transfer. Agree a cadence that matches how fast the data changes and how often the boundary can be crossed. For selectors from classified reporting, history often matters as much as the latest hour: earlier flows show when infrastructure first came into use, and who used it before. ## Questions to ask a provider - Does any component need to reach the internet, at installation or at run time? - Can the data be delivered in bulk, for one-way transfer, and in what formats? - How large is each delivery, and how often can it be refreshed? - Can analysts pivot on every selector type we hold, on our hardware, at our volume? - How is each delivery verified before it is loaded? ## Where Webscout fits The [Webscout Observability Platform](/solutions/platform/) runs on your premises, containerised and standalone for zero-footprint operations. Air-gapped deployments are available for select partners in high-side environments. Analysts pivot on any selector: IP address, domain, URL, JA4+ fingerprint, hash, email, ASN or country. [Covert network flows](/solutions/intelligence/covert-network-flows/), the traffic Webscout observes inside covert networks, can be delivered via S3 for on-premises ingestion and zero-footprint deployments. [Anonymising IPs](/solutions/datasets/vpn-proxy-detection/) and [Geo IP & network attribution](/solutions/datasets/geo-ip/) are available as bulk downloads in mmdb, jsonl, csv or parquet, so the context on every address can be carried across the boundary with the traffic.