Overview#
An investigator builds a digital profile of a subject by discovering accounts across platforms, but raw discovery gives only snapshots. To prove narrative continuity and reconstruct the subject's actual behaviour, the investigator needs to manually document observed activity: "Posted political manifesto on account X on 2024-03-15", "Profile name changed from Y to Z on 2024-05-12", "Added connection to known associate on 2024-06-01". Rather than keeping scattered notes in case files, the analyst now creates structured activity records directly on the subject's digital footprint timeline, with dates, types, descriptions, and attached metadata. Every record carries provenance: who created it, when, and why. These analyst-authored records sit alongside discovered accounts and automated findings to form a complete, auditable digital history.
This enriches investigation workflows by enabling manual provenance documentation, cross-referencing with case evidence, and collaborative narrative reconstruction of subject behaviour.
Key Features#
- Analyst-Authored Activity Creation: Investigators create structured activity records directly in the timeline, capturing observed or reconstructed digital behaviour with date, type, description, and optional metadata.
- Flexible Activity Types: Support for multiple activity classifications including posts, comments, shares, likes, profile updates, and connection additions, with extensibility for domain-specific event types.
- Chronological Timeline View: Activities display in date-sorted order, allowing investigators to visualise the subject's digital history across discovered accounts and manually documented events.
- Provenance Tracking: Every activity record captures metadata including analyst identity, creation timestamp, and optional supporting notes, maintaining accountability for investigative claims.
- Metadata Attachment: Activities support JSON metadata including engagement metrics, reach indicators, or custom contextual data relevant to the investigation.
- Integration with Discovery: Analyst-authored activities coexist with automated discovery findings on a unified timeline, enabling mixed-source evidence reconstruction.
- Case Integration: All activity records export with audit trails into investigation case files for presentation to prosecutors, courts, or internal stakeholders.
- Real-Time Refresh: After activity creation, the timeline refreshes immediately to reflect the new record without requiring manual reload.
Use Cases#
Law Enforcement Investigation#
Criminal investigators documenting suspect behaviour across social media accounts discovered through OSINT. When surveillance or sources reveal that a suspect posted recruitment material on a particular account on a specific date, the investigator creates an activity record documenting that observation, linking it to supporting evidence in the case file.
Fraud Examination#
Financial crime analysts enriching sockpuppet account profiles with documentation of observed coordinated behaviour. When multiple accounts show signs of operating in concert, posting within minutes of each other, cross-promoting fraudulent schemes, analysts create linked activity records on each account's timeline to establish the pattern and timeline of coordination.
Intelligence Assessment#
Intelligence officers reconstructing operational timelines for persons of interest. When communications intercepts or human source reporting reveal that a subject engaged in specific online activity on known dates, analysts create structured records on the subject's digital footprint to correlate with other intelligence and establish sequences of behaviour.
Corporate Security#
Corporate investigators documenting insider threat timelines. When a departing employee's account shows suspicious access patterns or a whistleblower reports specific actions, security analysts create activity records linking observed behaviour to investigation stages and supporting documentation.
Integration#
The Activity Timeline integrates with the broader Digital Footprint system through a GraphQL mutation that accepts analyst input (activity type, date, description, and optional metadata) and persists records to the footprint's activity ledger. The mutation returns an activity identifier and timestamp, enabling immediate timeline refresh. Activity records are retrievable via a paginated query that returns up to 100 records per footprint, sorted chronologically. The timeline renders in the Digital Footprint management interface, contextualizing analyst-created records alongside discovered accounts and enabling investigators to build mixed-source narratives. When investigations are exported for case presentation or litigation, all activity records are included with full audit trails showing creator identity and creation timestamp.
Open Standards#
- GraphQL (June 2018 specification): all activity-timeline operations, creating records, querying paginated activity lists, and polling discovery status, are exposed exclusively through a typed GraphQL schema with mutations and queries.
- ISO 8601 / RFC 3339: every activity date, creation timestamp, and verification timestamp is stored in UTC and serialised to ISO 8601 format; the mutation input parser rejects non-conforming date strings.
- JSON (RFC 8259): optional activity metadata and engagement metrics are stored and transmitted as structured JSON objects, with flexible JSONB persistence in the backing database.
- OAuth 2.0 / JWT (RFC 6749 / RFC 7519): all GraphQL operations require a valid RS256 JSON Web Token issued by the platform authorisation server and verified against a published JWKS endpoint before any activity record may be read or written.
- Role-Based Access Control (NIST RBAC / ANSI INCITS 359-2004): organisation-scoped RBAC is enforced on every query and mutation, ensuring only authorised personnel within the correct organisational boundary can create or retrieve sensitive digital footprint activity records.
- ArcSight Common Event Format (CEF): the platform audit trail that captures analyst identity and action provenance for activity records exports in CEF, enabling ingestion by SIEM platforms such as Splunk, Microsoft Sentinel, and IBM QRadar.
- GDPR (Regulation (EU) 2016/679): activity records are subject to case-lifecycle retention policies and GDPR subject access requests, with full audit trails supporting the right-of-access and accountability obligations under Articles 15 and 5(2).
Security & Compliance#
Activity records capture analyst identity and creation metadata for full auditability, maintaining accountability for investigative claims. All operations enforce organisation-scoped access control, ensuring that only authorised personnel can create or view sensitive digital footprint records. Timestamps and metadata support compliance with evidence handling requirements, and complete audit trails enable demonstration of investigative rigour to prosecutors and courts. Records are retained according to case lifecycle policies and subject to GDPR subject access requests.
Last Reviewed: 2026-06-04 Last Updated: 2026-06-04