Brand Colors
DNS Tool by IT Help San Diego Inc.
Canonical palette and standards-aligned color reference for design, engineering, and vendor handoff.
This page documents our brand identity palette alongside colors used for cybersecurity classification. Where formal specifications exist (e.g., FIRST TLP v2.0 defines exact hex values), we cite the standard directly. Where colors are industry convention rather than formal specification (e.g., CVSS severity colors used on NVD), we note that distinction honestly. Every claim on this page is independently verifiable via the linked sources.
Brand Palette
Core identity colors and surface tokens.Status & Severity Colors
Analysis indicators across all reports.Surface Tints
Background tints at 15% opacity for severity rows and badges.Traffic Light Protocol (TLP) v2.0
Information sharing classification.Colors specified by FIRST (Forum of Incident Response and Security Teams). Adopted by CISA on November 1, 2022. DNS Tool defaults to TLP:AMBER for all reports — security posture data may reveal actionable vulnerabilities.
CVSS v3.1 Severity Scale
Vulnerability scoring color alignment.Score ranges formally specified by FIRST CVSS v3.1. Colors are not part of the CVSS specification — they are de facto industry convention derived from the NIST NVD implementation and widely adopted across security tooling. Used for posture scoring and risk-level badges throughout reports.
Documentation & Citation Standard
Governing style for all reports, briefs, and output.All DNS Tool documentation, intelligence reports, and executive briefs follow NIST Special Publication 800-series conventions for structure and tone, augmented with IEEE-style numbered citations for RFC and protocol references.
- Summary
- Findings
- Evidence
- Impact
- Recommendations
- Tone: Authoritative, observation-based, factual. No hedging language. Direct statements of observed state.
- Technical references: IEEE-style numbered citations for RFCs, NIST SPs, and protocol standards (e.g., [1] RFC 7489, [2] NIST SP 800-177).
- Terminology: Use NIST/CISA vocabulary — "control", "finding", "observation", "recommendation", "risk level" — not academic terms like "hypothesis" or "methodology".
- Report titles: Intelligence-community format: "DNS Intelligence Report" / "DNS Intelligence Brief" (not "Analysis" or "Study").
- Visual identity: The NIST standard governs content structure and citation format, not visual design. Dark theme, hacker-culture fonts, and brand palette remain unchanged.
- Classification: FIRST TLP v2.0 remains the information sharing framework. Default: TLP:AMBER.
Why NIST over APA/Chicago? APA and Chicago are academic and publishing standards — they read as humanities or social science, not security operations. NIST SP 800-series is the native language of the cybersecurity community this tool serves: NIST, CISA, RFC authors, and enterprise security teams. IEEE citation format is adopted only for numbered protocol references within the NIST document structure.
The Owl Semaphore
Four states of knowledge — the Klein four-group V₄, a subgroup of O(2).The Owl of Athena encodes semantic state through orientation and color. The four transforms form the Klein four-group V₄ — the smallest non-cyclic group, where every non-identity element is its own inverse.
NORMATIVE
T = I det = +1
(x, y) → (x, y)
“This is the standard.”
NON-NORMATIVE
T = σv det = −1
(x, y) → (−x, y)
“This reflects the standard.”
CRITICAL
T = C2 det = +1
(x, y) → (−x, −y)
“This inverts the standard.”
T = σh det = −1
(x, y) → (x, −y)
Redundant encoding: Color + orientation + context label. The semaphore remains readable under color vision deficiency, small render sizes, and contexts where any single channel is degraded.
Standards mapping: Normative = RFC 2119 MUST/SHALL. Non-normative = Informative/NOTE. Critical = CVE/Security advisory. Metacognitive = Observer audit/Frame inversion.
Usage Rules
Palette governance for consistent output.- Standards-specified colors are non-negotiable. TLP colors must match the FIRST TLP v2.0 specification exactly — they are protocol requirements, not brand choices. CVSS severity colors follow NVD convention for ecosystem consistency.
- Status colors follow GitHub-dark conventions with 20% desaturation for professional appearance on dark backgrounds.
- Surface tints use 15% opacity of their parent color to maintain readability while providing visual grouping.
- WCAG AA minimum contrast is maintained across all text/background combinations. Executive print reports use minimum 11pt body text.
- No ad-hoc colors. All new colors must be documented here with their token name before use in production.
- TLP:AMBER is the default report classification per CISA Cyber Hygiene practice — security posture data may reveal actionable vulnerabilities.
DNS Tool v26.45.09 · IT Help San Diego Inc. · Colors last verified February 2026