Overview#
An analyst receives a USB drive containing 400 documents, 12 audio recordings, and 80 images seized during a search. Processing these manually would take weeks. She submits the batch to the Intelligence domain: documents are classified and have entities extracted, audio recordings are transcribed and key statements are flagged, images are analysed for faces, objects, and text. An entity-relationship graph is generated from the extracted text. Within hours, a structured intelligence picture has emerged from material that would have taken a team of analysts days to process by hand.
The Intelligence domain is the AI orchestration layer for the platform. It coordinates complex analytical workflows across multiple modalities and surfaces the results in formats that investigation workflows can act on directly, from entity extractions that feed the entity graph to classified reports that inform mission planning.
Key Features#
- Multimedia AI analysis for documents (PDF), images, audio, and video
- Entity and relationship extraction from unstructured text with automated graph generation
- Graph generation from text analysis for relationship network visualisation
- Pattern of life behavioural analysis over configurable time ranges
- Investigation orchestration from natural language prompts with file attachments
- AI-powered mission planning for target profiles
- Intelligence report management with classification levels and source tracking
- Intelligence source management with reliability ratings and activity status
- File upload validation with MIME type and extension verification
Use Cases#
- Starting investigations from natural language prompts, with supporting documents attached, to rapidly scope a new case
- Extracting entities and relationships from unstructured intelligence documents and populating the investigation's entity graph automatically
- Processing multimedia evidence: transcribing audio for key statements, extracting key moments from video, and analysing images for persons, objects, and text
- Creating and managing classified intelligence reports linked to investigations, with classification level controls governing who can access each report
Industry Context#
Counter-terrorism units use multimedia AI analysis to process large volumes of seized digital media at a pace that keeps pace with operational timelines. Military intelligence analysts use pattern of life analysis to characterise subject behaviour and identify deviations that signal operational planning. Financial crime investigators use entity extraction to process hundreds of corporate documents and automatically map beneficial ownership structures. National signals intelligence agencies maintain classified source libraries with reliability ratings and use them to annotate extracted intelligence reports. Serious fraud offices process multi-gigabyte document productions through AI extraction pipelines to identify key transactions and relationships.
Integration#
The Intelligence domain integrates with Investigation for case management, Partner Orchestrator for AI coordination, Evidence Object for evidence handling, Search for content indexing, and Monitor for automated monitoring. AI processing runs asynchronously with results persisted to PostgreSQL and the relationship graph updated in Neo4j.
Open Standards#
- GraphQL (June 2018 Specification): the entire Intelligence domain API is exposed as a GraphQL schema, with typed queries and mutations for multimedia analysis, entity extraction, intelligence report management, and pattern-of-life retrieval.
- IANA Media Types (RFC 2046): file upload validation enforces an allowlist of registered MIME types (application/pdf, text/plain, application/vnd.openxmlformats-officedocument.wordprocessingml.document, and image/audio/video subtypes) before any AI processing is invoked.
- Exif (CIPA DC-008): image evidence analysis extracts Exif metadata including GPS coordinates, capture timestamps, camera make and model, and ISO speed ratings to provide forensic context alongside AI-generated findings.
- ISO 32000 (PDF): PDF documents are ingested directly for text extraction and multimodal AI analysis, with the document's MIME type and content structure handled in conformance with the PDF file format specification.
- ISO 639-1: the language detected in extracted evidence text is recorded as an ISO 639-1 two-letter code, enabling downstream multilingual NER pipelines to operate on a translated normalised form of the content.
- openCypher / ISO/IEC 39075 (GQL): entity and relationship data extracted from intelligence sources is persisted to a Neo4j property graph and queried via Cypher, populating the investigation entity graph used across the platform.
- ISO 8601: all intelligence report creation and update timestamps, pattern-of-life date ranges, and evidence processing timestamps are stored and exchanged as ISO 8601 UTC datetime strings.
Last Reviewed: 2026-02-05 Last Updated: 2026-04-14