Learn the workbench.
Keep your work moving.

1. Get the correct release through your publisher's confirmed delivery channel. This public guide does not provide protected software or establish subscription access.
2. Extract the entire ZIP. Keep the FieldKit and Help folders beside the start files. Opening files inside an unextracted ZIP can break local assets.
3. Open START-FIELDKIT.html for local reports, builders and references. Core pages do not need a native runtime.
4. For live Windows measurements, install Node.js 24 or later from its official website if needed. Double-click START-LIVE-MONITOR.cmd and keep its terminal open.
5. Open the localhost console address printed by the terminal. If files are missing, extract a fresh complete copy instead of moving individual module files.

A Windows launcher is not an Android APK or phone malware scanner. Native protection checks depend on the operating system.

1. Open Console home in the companion-served localhost console. The hosted website cannot inspect your operating system directly.
2. Copy the pairing code from the companion terminal into the local monitor and choose Connect this computer. Keep it private. The code stays in memory; restart the companion for a fresh code when it expires.
3. Review timestamps, CPU, memory, disk space and available Windows protection checks. The light describes the connection, not a clean-security verdict. Missing or unsupported readings stay unknown.
4. To run a real malware check, explicitly authorise Microsoft Defender quick scan and start it. Existing Defender policy may contact Microsoft or quarantine detections; FieldKit does not change that policy.
5. Use Windows Security for results and actions. Request acceptance is different from completion. Disconnecting FieldKit does not cancel a scan already started.

Runtime polling pauses while hidden. Windows protection collection is slower and bounded. Monitoring does not prove an operating system is trustworthy or detect every compromise.

1. Record systems you own or have written permission to assess, permitted test types and the assessment window. Keep authorisation in your approved records.
2. In Security Center, choose the assessment workflow. Command builders prepare bounded commands for separately installed tools such as Nmap, ZAP baseline, testssl.sh or Trivy.
3. Check the terminal, approved target and prerequisites. Review the generated command before running it on your assessment computer.
4. The browser does not execute external scanners or grant rights to third-party software. Installation, licences, costs and operating-system support are separate.
5. Retain the original report and review findings with their scope and uncertainty. A successful command does not establish that every vulnerability was found.

Tool-directory links, plans and account entitlements do not grant permission to access another person's systems.

1. Use Blue Team for supported SARIF, Trivy JSON or Nuclei JSONL files within the tool's displayed limits. Keep original reports for details omitted from summaries.
2. Enter up to eight known public handles and build candidates across sixteen platform templates. A prepared URL is not a verified account.
3. The optional batch makes explicit public API requests to GitHub, GitLab and Hacker News. Review consent and limits first; providers see the handle and your network address.
4. Other platform links are manual research leads. Record public evidence URLs, status and notes. Shared spelling does not prove profiles belong to one person.
5. Filter candidates and export to keep your research. Imported files remain unverified; importing a record does not authenticate its claims.

Check exported files before choosing the saved confirmation. If a download inside the console does not start, use Open separately and re-import the original file there. Keep private account information, client secrets, private addresses and unrelated personal records out of research notes and support questions.

1. Choose a country or region, topic and period. The map supplies geographic context; it does not locate verified events or depict current front lines.
2. Start collection explicitly. Direct mode contacts the public provider. Hosted mode needs your publisher's configured service and access settings.
3. If a request times out, is rate limited or returns unsupported data, read the error and next permitted attempt. Repeated clicking can worsen provider limits.
4. Retained reporting, notes and bookmarks stay available after failure. Cached or imported snapshots are not fresh reporting; review their collection times and source labels.
5. Broaden filters if a successful request has no reports. Export JSON before closing. Timed previews need an explicit keep/export action to retain them.

News mentions and retrieval times are not verified locations, event times or independent intelligence. Shared caching and central rate limiting need a configured hosted service.

1. Export work before closing, refreshing, clearing browser storage or moving devices. Browser copies stay with that browser/profile; copying the app folder does not move them.
2. Keep the previous app version and exports separately in storage appropriate to their sensitivity. Do not attach recovery keys or credentials to support requests.
3. Use Access & updates only with the publisher's confirmed service and trusted verification keys when configured. An admin token or another vendor's API key is not a subscription credential.
4. In build 0.10.2 or later, open Access & updates → Troubleshooting to generate a local support summary. Review its exact text before copying or downloading. It contains build and browser capability information, not keys, accounts, cases or scan results; it does not submit a support ticket.
5. Check release identity, supported platforms and notes. SHA-256 checks equality with an expected file; a digest alone does not establish publisher authenticity.
6. The current development preview is unsigned. Production signing and automatic customer delivery remain configuration and acceptance requirements.

Updates should not ask you to disable antivirus, add blanket exclusions or bypass a browser security warning. Verify unexpected requests through the publisher's confirmed channel.