Operation IntelWeave — Converged Intelligence Operating System

The Command Centre for
Every Investigation

IntelWeave CIOS fuses Signal Intelligence, Graph Brain, Visual AI, Solvability Scoring, and Smart City Command into one hardened operational platform — purpose-built for law enforcement, organised crime units, and national security agencies across the Indo-Pacific.

Access Platform →Explore All 7 ModulesPublic feature catalog
Configured
Scoring Workflow
7
Intelligence Modules
Selected
Analytical Workflows
12
Release Highlights
Research
References
Varies
Deployment Scope
◆ Illustrative Status
Signal Intelligence · Example
Graph Engine · Example
Visual AI · Example
Desktop Agent · Standby
Smart City Feed · Example
AI Copilot · Example
Intelligence Modules

Seven Pillars of Operational Intelligence

Every module supports investigation workflows — from CDR acquisition through case analysis. All seven operate on a unified graph data fabric with shared RBAC, telemetry, and event diagnostics.

📡
MOD-01
Signal Intelligence
Configured call-record analysis can combine selected temporal, device, and network signals for investigator review. Available signals and scoring behavior depend on source data and workflow configuration.
Supports call-record analysis, tower-data ingestion, and timezone-aware crime windows. Exports analytical profiles for investigator review.
CDR AnalysisTower DumpBurner DetectionIMEI HistoryCo-Location9 Detection PassesComposite Score
🧠
MOD-02
Graph Brain
Graph analysis can combine research-informed suspicion scoring, community detection, and node ranking to surface candidate network patterns for investigator review. Results depend on available data, configuration, and analyst assessment.
Available graph analysis and rendering behavior depends on the configured deployment and dataset size.
Graph AnalysisCommunity DetectionNode RankingCandidate PatternsAnalyst Review
👁
MOD-03
Visual Intelligence
Configured visual workflows can analyze supported live or recorded media using selected detection models and confidence thresholds. Availability, data handling, and processing behavior depend on the selected deployment and workflow.
Supported stream and file formats vary by configured provider and desktop workflow.
Visual AnalysisDetection ModelsDesktop WorkflowsConfigured Streams
📋
MOD-04
Case Management
Case lifecycle workflows include evidence tagging with provenance references, witness management with protected-status handling, CDR session linking, case numbers, forensic status tracking, and solvability delta monitoring. Multi-tenant RBAC scopes access across organisations.
Role assignments and workspace data scoping depend on configured account and organization policies.
Case LifecycleEvidenceProsecutionMulti-TenantWitness ProtectionForensicsCourt Numbers
🎯
MOD-05
Solvability Engine
A configurable parameter-based scoring workflow with research references that include INTERPOL INSIGHT, FBI clearance-rate studies, and UK Home Office forensic research (2013). Scores can be reviewed at intake and after configured CDR and graph analysis; scores are decision-support signals, not outcome guarantees.
Scoring fields and categories depend on the configured assessment workflow.
Configurable CriteriaPre/Post ReviewAssessment CategoriesINTERPOL ResearchFBI ResearchUK Home OfficeScore Changes
🔮
MOD-06
Predictive Intelligence
Configured analysis may summarize available historical call-record or event data over selected time buckets. Any displayed patterns are dependent on source coverage and should be reviewed by an analyst.
Available analysis windows and alert behavior depend on data and deployment configuration.
Hotspot PredictionSmart CityGeofencingRisk ProfilingHeatmapsEmergency RoutingGang Patterns
⚡
MOD-07
Fusion Intelligence
Configured search workflows can bring selected records together for analyst review. AI-assisted search and collaboration depend on enabled providers, data sources, and deployment configuration.
Response time and collaboration availability depend on configuration, service health, and query complexity.
Fusion SearchAI CopilotAnalyst CollaborationCross-DomainConfigured EventsShared ReviewMulti-Model AI
Selected capabilities

Clear scope and availability

Explore selected administration and diagnostics features, with audience and availability notes.

Public feature catalog
Investigation Pipeline

From Intake to Prosecution in One Platform

IntelWeave CIOS guides every investigation through a structured pipeline — automatic solvability scoring at each stage ensures resources go where they matter.

📥1
Case Intake
Create case · assign investigators · link incident report · set crime window
📡2
CDR Import
Upload tower dump · 9-pass detection runs · burner + ring flags generated
🎯3
Solvability Score
100-parameter pre-analysis score · resource allocation recommendation
🧠4
Graph Analysis
FRAUDAR ring detection · PageRank mastermind · Louvain communities
👁5
Visual Correlation
ANPR plate match · face recognition · co-location with CDR towers
⚡6
Fusion Search
Cross-domain query · AI Copilot briefing · multi-analyst War Room
📋7
Evidence Review
File-integrity references · PDF report · scoring summary · supported diagnostics
Signal Intelligence — Deep Dive

9 Detection Passes. One Composite Score.

Every imported CDR dataset runs through nine sequential detection algorithms in parallel. Results are fused into a single 0–100 composite risk score per subscriber, updated on every re-analysis.

📈
Pre-Crime Surge
Computes a 7-day rolling call-rate baseline per subscriber. Crime-window rate vs baseline ratio >2× triggers a flag. Weights: frequency, contact diversity, tower spread. Feeds ring detection as a co-occurrence signal.
🔇
Post-Crime Silence
Monitors call-rate collapse in the 48h following a crime window. Silence <20% of baseline is scored as a phone disposal or deliberate evasion signal. Cross-referenced with IMEI change events.
💥
Coordinated Burst
Detects ≥3 subscriber numbers spiking simultaneously within 30-minute buckets. The synchronisation coefficient (overlap / union of spike windows) is added to each subscriber's composite score as an operational co-ordination signal.
📱
Burner Phone Detection
Composite burner score: short active lifespan (<21 days) + ≥1 IMEI swap + ≥2 SIM rotations + single-purpose call graph (one dominant contact cluster). Each sub-score contributes to the overall risk profile.
🌙
Night-Ops OPSEC
>85% of calls between 22:00–05:00 local time. Weighted more heavily when combined with post-crime silence and burner score. IST timezone-aware for Indian workspaces. Configurable per workspace key.
📍
Co-Location Analysis
Detects physical co-presence of two or more subscribers at the same tower within any configurable 30-minute window. Outputs a co-location matrix with strength score. Used to establish meeting patterns and planning events.
🔁
SIM Rotation & Cloning
Multiple SIMs active on the same IMEI, or the same MSISDN appearing on multiple IMEIs, triggers fraud flag. Full IMEI history table maintained per workspace. Detects cloning even across CDR import batches.
🕸
Ring Membership
FRAUDAR suspicion score: edge density per √nodes. Camouflage-resistant — rotating SIMs cannot dilute ring density below threshold. Each subscriber's ring membership contributes a weighted component to composite score.
📉
Temporal Anomaly
Statistical deviation from a subscriber's own 90-day historical call pattern using a z-score over rolling 7-day windows. Flags behavioural shifts independent of peer comparison — catches lone actors who don't fit group patterns.
Illustrative CDR Dashboard — Subscriber A● ILLUSTRATIVE
Composite Risk Score
87/ 100
▲ High Risk · 4 flags active · Recommend immediate action
Pre-Crime Surge3.4×
Post-Crime SilenceActive
Night-Ops OPSEC91%
Ring MembershipRing A
Burner Score62/100
Co-Location Hits7 sessions
Subscriber A → Subscriber B · Sample RecordsSample Signal
Tower: LAGOS-NW-04 · 2024-11-12 · Co-locatedCo-Located
IMEI changed 3× in 14 days · SIM RotatedBurner
Graph Brain — Criminal Network Analysis

See the Network Behind the Calls

Graph visualizations can help analysts review network relationships. Performance and available analysis depend on dataset size and the configured deployment.

Graph Brain — Ring Registry · Workspace W-04● ACTIVE
Ring A — Masterminds12N·67ERisk 94
Ring B — Distribution8N·31ERisk 78
Ring C — Financial Layering6N·18ERisk 71
Ring D — Logistics Support4N·9ERisk 52
◈ Bridge Nodes Escalated
• Analyst A · connects Sample Group A ↔ B
• Analyst B · connects Sample Group B ↔ C
PageRank
0.847 — Mastermind
Community
Louvain: C-04
FRAUDAR
Suspicion: 0.91
Bridge Type
Hub → Spoke
🔬
FRAUDAR Algorithm (KDD 2016)
Research-based suspicion scoring using edge density relative to network size. Outputs are analytical signals for investigator review; results depend on input data and configuration.
🏘
Louvain Community Detection
Automatically partitions nodes into communities based on call density. Each community receives a composite risk tier inherited from its highest-risk members. New community members auto-inherit risk context without manual re-analysis.
👑
PageRank Ranking
Ranks nodes using graph relationships and inbound edge weights. Rankings and bridge-node metrics surface candidate patterns for analyst review; they do not establish a person’s role or intent.
⚡
Background Processing
Supported graph-analysis tasks may run in background jobs. Completion time and scale depend on the configured service and dataset.
🎨
Graph Visualisation
Graph views can present available nodes and relationships for analyst review. Rendering performance depends on data volume and device capability.
🔗
Temporal Graph Analysis
Timeline views can help analysts review changes in network relationships over time and identify earlier or newly active nodes. Patterns are investigative leads and do not establish planning or intent.
Configurable Solvability Workflow

Review Case Factors — At Intake

The solvability workflow offers configurable scoring at intake and after analysis, with changes available for investigator review. Scores are decision-support signals, not predictions or guarantees of case outcomes.

78/100
◆ Illustrative score — analyst review
↑ +31 pts gained since intake
High
80–100
Moderate
60–79
Developing
40–59
Low
20–39
Critical
0–19
Physical Evidence
15 params · 14% weight
Fingerprints, DNA, trace materials, CCTV frames, weapon ballistics, toolmarks, biological samples
Digital & Telecom
15 params · 16% weight
CDR records, tower dumps, IMEI history, IP logs, device forensics, social media, encrypted app artefacts
Network Analysis
10 params · 11% weight
Ring membership, bridge-node role, community risk tier, PageRank score, contact network depth
Witness & Testimony
10 params · 12% weight
Eyewitness reliability score, corroboration count, protected witness status, recantation risk flag
Case Characteristics
10 params · 8% weight
Crime type classification, jurisdiction, modus operandi fingerprint, repeat offender flags, victim count
Investigative Progress
15 params · 18% weight
Arrest status, search warrants executed, forensic lab submissions, prosecution readiness, inter-agency referrals
Time-Critical Factors
10 params · 9% weight
Days since offence, evidence perishability index, suspect flight risk, statute of limitations proximity
Legal & Prosecution
8 params · 7% weight
Court case number, legal aid status, prior convictions, charge readiness, co-accused disposition
Resources & Support
7 params · 4% weight
Investigator capacity, forensic lab availability, inter-agency cooperation, specialist resource access
Smart City Command Centre

The City Is Your Sensor Grid

Illustrative city-workflow concepts show how configured camera, plate-read, call-record, and incident data could be reviewed together. No live feed or deployment is represented in this preview.

🗺
Crime Hotspot Heatmap
Historical CDR event density combined with CCTV alert frequency generates a probabilistic crime hotspot layer updated every hour. City-block granularity. 24h and 7-day prediction windows configurable per jurisdiction.
📡
Tower Density Overlay
Where configured, call-record tower data can be summarized as a heatmap. Analysts can review density patterns in context; results depend on source coverage and data quality.
🚘
ANPR Record Review
Where an ANPR source is configured, authorized users can review available plate-read records in the fusion workspace. The displayed records do not establish a vehicle’s complete route or history.
🏛
Electoral & Public Safety
Configured incident records may be organized with location context for analyst review. Any related alert or dispatch workflow depends on available data and deployment configuration.
🚨
Geofenced Alert Zones
Draw custom alert zones on the city map. Any ANPR hit, CDR spike, or CCTV detection within the zone triggers a push notification with evidence context. Time-bounded zones for planned operations.
🔮
Emergency Response Planning
Configured planning workflows may display available location and incident context. This preview does not represent live responder tracking, routing, or dispatch.
City Intelligence Feed · Metro DistrictILLUSTRATIVE
Illustrative Zone Index
Central District
78%
North Quarter
52%
East Industrial
41%
Port Authority
35%
South Residential
18%
West Commerce
22%
ANPR Alert · Plate DEMO-PLATE · SampleAlert
CDR Spike · Tower NW-04 · +340% volumeWatch
3 response units dispatched · ETA 4 minEn Route
24h Prediction · Central District
Based on CDR density (92nd percentile) + 3 CCTV alerts + historical crime pattern match — High probability incident 23:00–02:00
Desktop Agent — Field Operations

Scan Offline. Upload Only What Matters.

The IntelWeave Desktop Agent runs natively on Windows and macOS using Tauri 2.0 (Rust). ONNX inference runs on-device. Raw video never uploads. Only detection metadata — bounding boxes, labels, timestamps, confidence — is transmitted.

💾
Offline-First Architecture
Full detection pipeline runs locally on any Windows or macOS laptop. No internet connection required for scanning. SQLite queue persists all detections and file manifests across network outages.
🔒
Detections-Only Mode (Default)
Raw video files NEVER leave the device. Only detection metadata is transmitted: bounding boxes, class labels, confidence scores, timestamps, and file SHA-256. Bandwidth per detection: ~1 KB.
👁
ONNX On-Device Inference
YOLO models execute via ONNX Runtime with optional GPU acceleration. Supports face detection, license plate reading, object classification, and motion detection — all running CPU/GPU locally.
📁
Folder Monitoring
The configured desktop workflow can monitor selected folders and add supported media to a local processing queue. File formats and behavior depend on the installed agent version.
🔗
File integrity references
Configured desktop workflows can calculate SHA-256 file hashes and retain them with detection metadata. A hash alone does not establish chain of custody or legal admissibility.
🔄
Automatic Sync & Heartbeat
30-second heartbeat to the platform API. File manifest and detection results upload when connectivity is restored. Sync queue survives agent restarts. Per-agent revocable tokens stored as SHA-256 hashes.
Operating Modes
🔒
Detections Only (Default)
ONNX inference runs locally. Only detection metadata synced to platform. Raw video stays on device permanently. Bandwidth: ~1 KB per detection. Best for bandwidth-constrained field operations.
⏳
Deferred Upload
Raw clips flagged for review upload during configured off-peak windows. Full cloud analysis after upload. Bandwidth: controlled upload windows 02:00–06:00 by default. Best for high-value evidence.
✈
Air-Gapped
Zero network connection. All detections stored in encrypted SQLite. Results export to AES-256 encrypted USB drive for manual transfer to a connected IntelWeave instance. Best for classified facilities.
◆ Tech Stack
Tauri 2.0 (Rust)ONNX Runtimenotify (folder watch)rusqlite (SQLite)SHA-256 streamingreqwest (rustls-tls)React 18 UIAES-256 export
Visual Intelligence — Semantic Video Search

Find Any Moment in Any Footage

SentrySearch transforms passive CCTV archives into a queryable intelligence asset. Describe what you're looking for in plain language — or drop a reference image — and the engine scans thousands of indexed clips using Gemini Embedding 2 semantic vectors, on-device ONNX scene detection, and pgvector ANN search to surface every matching moment across your entire camera grid. Air-gapped operations are fully supported via local Qwen3-VL inference with no cloud dependency.

Offline Pipelines — Zero Cloud Dependency
💻
ONNX On-Device
YOLO scene-detection and feature extraction run via ONNX Runtime on CPU or GPU — no API calls required. Processes multi-hour recordings without egress.
🤖
Local Qwen3-VL
Vision-language model running fully on-device via DashScope-compatible local endpoint. Generates rich scene captions for semantic search without any cloud dependency.
🎬
FFmpeg Scene Detection
Boundary detection via scene-change histogram analysis. Segments continuous recordings into semantically coherent chunks before indexing.
🔁
Perceptual Hash Comparison
Configured perceptual-hash comparisons can help identify similar or duplicate frames before embedding. Results and resource impact depend on source media and settings.
✈
Air-Gapped Export
Encrypted SQLite chunk store with AES-256 export for transfer to classified environments. Compatible with Desktop Agent chain-of-custody requirements.
Configurable Online Pipelines
🌐
Embedding Providers
Configured embedding providers can prepare supported content for semantic search. Model availability, indexing scale, and response time depend on provider and deployment settings.
☁
Qwen Cloud (DashScope)
Alibaba Cloud DashScope API can provide scene-captioning inference for supported uploads that exceed local GPU capacity, with configured fallback to local inference.
📡
RTSP Ingestion
Where configured, RTSP stream processing can segment supported feeds and make processed content available for search. Processing delay and availability depend on the selected provider and deployment.
⚡
RunPod Serverless GPU
Burst GPU capacity via RunPod for batch re-indexing of large archives. Cost-efficient serverless model: 0 idle cost, spins up only when queued jobs exceed local capacity.
🔄
Inngest Batch Processing
Background indexing jobs managed via Inngest step functions. Chunked into survivable units that resume from last checkpoint after Vercel serverless timeouts.
Powered byGemini Embedding 2Qwen3-VLONNX RuntimeChromaDB-compatiblepgvectorInngest
SentrySearch — Illustrative Preview
Sample Video Search · Entrance CamerasSAMPLE
🔍red truck at entrance 23:00Search
threshold: 0.78mode: textscope: cam-entrance-01, cam-entrance-02
✓ 3 results · scanned 1,247 chunks · 84ms
▶
23:02:14 – 23:02:44
cam-entrance-01 · Scene: vehicle approach
HIGH 0.94
▶
22:58:07 – 22:58:37
cam-entrance-02 · Scene: parking lot entry
MED 0.82
▶
23:11:55 – 23:12:25
cam-entrance-01 · Scene: vehicle departure
LOW 0.79
Pipeline:gemini-embed·1,247 chunks indexed·$0.42 total·pgvector ANN·HNSW index
Anomaly Highlights · Top 2
0.91
23:04:01 – 23:04:31
0.73
22:51:18 – 22:51:48
◆ Image Search Mode
Drop a reference image — a suspect photo, a vehicle crop — and SentrySearch finds all clips containing visually similar content via multimodal embedding comparison.
Security & Compliance

Security Controls and Administration

The platform includes session validation, role-based access controls, rate limits on supported AI endpoints, and structured diagnostics. Controls vary by configured deployment and do not constitute a certification or guarantee.

🔐
Database Access Controls
Database access controls and session context are applied in supported application paths. Exact coverage depends on the configured deployment and should be verified for each data access path.
Access ControlsSession ContextConfigured Paths
🛡
Administrator Sessions
Administrator access uses password-based entry and session validation. Additional verification may be required for selected actions; available controls depend on the configured account and deployment.
Password EntrySession ValidationAction Verification
👥
Role-Based Access
Role assignments and organization or workspace scoping help control access in supported workflows. Access behavior depends on account setup and configured application paths.
Role AssignmentsWorkspace ScopingConfigured Paths
📋
Structured Event Diagnostics
Supported diagnostic events can include structured fields such as event type and timestamp. Coverage is limited to supported logging paths and does not indicate legal or compliance status.
Structured EventsSupported PathsReserved MetadataRedaction
🔑
Agent Credentials
Supported desktop-agent workflows use registration credentials to associate an agent with its configured account. Storage, lifecycle, and revocation details depend on the specific deployment.
Configured RegistrationAccount AssociationLifecycle Controls
⚡
Service Rate Controls
Rate controls may apply to supported AI endpoints. Limits and enforcement depend on the configured service and deployment.
Supported EndpointsConfigured LimitsService Controls
🔍
Diagnostic Redaction
The supported structured logger masks common credential fields and recognized token or URI patterns. It does not cover every possible secret or logging path.
Structured LoggerCommon Credential FieldsRecognized Patterns
🌐
Database Function Configuration
Function-level database settings vary. Review the configuration of each function and deployment before relying on a specific isolation or search-path property.
Function-Level SettingsDeployment ReviewConfiguration Dependent
Platform Capabilities

Every Tool. One Platform.

Selected analytical workflows can work with configured case and data sources. Available tools, shared context, and access behavior depend on the selected deployment.

📡
Device-Pattern Review
Where available, analysts can review device lifespan, identifier changes, and calling patterns as separate signals. These patterns do not establish device ownership or intent.
📍
Co-Location Analysis
Configured analysis can compare records associated with the same tower over a selected time window. Coverage and precision depend on source data; results require analyst review.
⏱
Call-Pattern Changes
Configured baselines can help surface changes in call activity around a selected period. A change is a heuristic signal, not evidence of planning.
🔇
Call-Activity Changes
Analysts can review changes in call activity against configured baselines. Reduced activity alone does not establish disposal, evasion, or cause.
💥
Call-Activity Clusters
The system can surface groups of records with similar timing for analyst review. A cluster does not by itself establish coordination or intent.
🕸
Criminal Ring Detection
FRAUDAR-derived suspicion scoring uses graph density as an analytical signal for investigator review.
🔱
Bridge-Node Metrics
Graph metrics can highlight nodes that connect candidate groups. The metric is a lead for analyst review, not a finding about a person’s role.
🌙
Time-of-Day Patterns
Call timing can be compared with a configured baseline. Unusual hours are descriptive signals and do not establish operational behavior.
🗺
Location & Time Analysis
Where timestamped tower records are available and configured, analysts can review associated location data alongside call records. Coverage and precision depend on source data and do not establish a complete route.
🏛
Evidence File Tools
Configured workflows may provide PDF exports and SHA-256 file hashes for review. These tools do not establish chain of custody, legal admissibility, or compliance with an agency standard.
🤖
AI Copilot
Where enabled, natural-language prompts can help query configured case or graph data. Results and response times vary with data, providers, and deployment.
🔐
Workspace Access Controls
Supported workflows use configured account roles and workspace scoping to help manage data access.
⚡
Video Stream Connectors
Selected deployments may connect supported video stream sources and configured monitoring rules.
📊
Operational Telemetry
Supported application paths can expose selected operational events and service measurements; coverage depends on instrumentation and configuration.
🌍
Cross-Jurisdiction Analysis
Where supported datasets and access are configured, analysts can compare selected records across jurisdictions. No agency integration or data-sharing arrangement is implied.
⚖
AI Bias Audit Engine
Fairness review, model drift detection, and explainability reports for configured oversight workflows.
🛡
Witness Protection Module
Protected subject tracking, threat levels, relocation management, secure access tiers.
🗳
Electoral Operations
Configured workflows may organize polling-site incidents and related records for review; this does not imply a live election deployment.
🏥
Corrections Workflows
Configured workflows may organize records and risk-review context; availability and source coverage depend on deployment.
🔮
Historical Activity Summaries
Configured call-record and event data can be summarized over selected time periods. Summaries are not crime probabilities or predictions.
💳
Usage & Billing Metering
Per-API-call billing, vendor cost metering, credit wallet management, usage analytics dashboard.
🔌
Adapter Registry
Plug in external geo, AI, video, storage, and graph providers without modifying core platform logic.
📂
Case Import & Migration
Bulk case import from legacy spreadsheets, CRUD history migration, workspace key assignment.
🔭
Temporal Pattern Review
Configured baselines can help analysts identify records that differ from historical patterns. Findings depend on data coverage and require contextual review.
👤
Subscriber Risk Profiling
Composite profile: CDR risk + graph tier + IMEI history + temporal anomaly + ring membership.
📧
Alert & Notification Engine
Push alerts for hotspot triggers, ANPR hits, CDR spikes, geofence breaches. Configurable routing.
🗂
Forensic Status Tracking
Lab submission status, expected turnaround, result integration, solvability impact calculation.
⚔
Analyst Collaboration
Selected deployments may provide shared analysis tools and case notes for authorized collaborators.
🔢
IMEI & MSISDN History
Full IMEI swap timeline, MSISDN-to-IMEI mapping, cloning detection, device fingerprinting.
📈
Investigation Progress Tracker
Solvability delta per case, parameter-level gaps, recommended next investigative actions.
🌐
Multi-Language CDR Ingestion
Handles CDR formats from 12+ telecom carriers. Column mapping wizard. Schema validation at ingest.
🔄
Inngest Background Engine
PageRank, community detection, large CDR batch processing — all in chunked background jobs.
Operational Use Cases

Built for the Hardest Investigations

Illustrative scenarios show how configured analytical tools may support investigation workflows. They are not customer case studies, measured results, or promises of investigative outcomes.

CASE-01
Organised Crime Networks
Investigators upload CDR exports from multiple suspect phones. IntelWeave runs all 9 detection passes simultaneously, detects ring structure via FRAUDAR, identifies the mastermind node via PageRank, and generates a bridge-node report showing which suspects connect multiple sub-rings.
◆ Illustrative scenario: graph analysis presents candidate connections for investigator review.
CDR AnalysisRing DetectionPageRankEvidence ReportBridge Nodes
CASE-02
Counter-Terrorism Operations
Tower dump from a 5km radius of an incident site ingested. Co-location analysis identifies which MSISDN pairs were physically together during the planning window. Temporal anomaly detection flags behavioural shifts 72h before the event. AI Copilot generates a natural-language suspect brief.
◆ Illustrative scenario: analysts review possible co-location patterns and configured watchlist matches.
Tower DumpCo-LocationTemporal AnomalyAI CopilotWatchlist Match
CASE-03
Missing Persons Investigation
Investigators may review available tower and call records alongside contact-network patterns. Record coverage and location precision vary; the tools do not determine a person’s complete route or whether a device changed hands.
◆ Illustrative scenario: analysts compare available call and tower records as investigative leads.
Call RecordsContact NetworkDevice EventsTower DataAnalyst Review
CASE-04
Financial Crime & Fraud
CDR records cross-referenced with financial transaction timestamps. Money mule networks identified by call pattern clustering around transaction events. Fusion search correlates ANPR plate reads (cash pickup locations) with phone CDR at the same time and place.
◆ Illustrative scenario: analysts compare available call-record and transaction timestamps for potential links.
Fusion SearchANPR CorrelationMule NetworksFinancial RecordsCDR Timing
CASE-05
Election Security Operations
CCTV feeds from polling stations monitored via YOLO detection. Crowd density alerts trigger when thresholds exceeded. CDR communication patterns among known interference actors analysed during polling hours. Geo-tagged incident reports stream into Smart City dashboard for command visibility.
◆ Illustrative scenario: configured alerts and submitted incident reports are reviewed together by an analyst.
Polling StationsGeofence AlertsCDR BurstIncident ReportingSmart City
CASE-06
Border & Immigration Intelligence
Where supported datasets and access are configured, analysts may compare selected records across jurisdictions. This example does not imply an agency integration, shared watchlist, or data-sharing agreement.
◆ Illustrative scenario: analysts examine selected records available to their configured workspace.
Configured DataAnalyst ReviewJurisdiction Context
Why IntelWeave

From Manual Silos to Converged Intelligence

Legacy investigation workflows fragment evidence across spreadsheets, siloed tools, and manual processes. IntelWeave CIOS unifies everything in one secure, audited, AI-assisted platform.

CapabilityManual / Legacy Approach◆ IntelWeave CIOS
CDR to risk scoreHours of manual Excel pivot analysis — error-prone, unauditedConfigured call-record analysis and scoring for analyst review
Criminal ring detectionAnalyst manually draws link charts · misses SIM-rotating membersGraph-assisted candidate grouping for analyst review
Solvability assessmentGut feel at intake · no data-backed resource allocationConfigurable scoring and post-analysis review · research-informed
CCTV & CDR correlationManual timestamp matching across two separate systemsGeo-temporal fusion in single query · co-location in 30-min windows
Evidence file toolsManually assembled · inconsistent · no chain of custody audit trailConfigured exports and file-integrity references for review
Workspace collaborationSeparate tools and manually exchanged recordsConfigured workspace access controls and supported collaboration tools
AI investigation assistNot availableWhere enabled, natural-language prompts can query configured data; response times vary
Offline field scanningPaper notes · photos on personal device · no custody chainDesktop agent: ONNX on-device · SHA-256 · SQLite queue · AES-256 export
Network analysisManual review across call records and link chartsGraph metrics can surface candidate relationships for analyst review
Location and event summariesHistorical incident records reviewed separatelyConfigured data can be summarized for selected time periods
Platform Architecture

Production-Grade from Day One

The platform architecture includes separate application and graph data connections, caching, background jobs, and a multi-model AI engine with configured provider fallback. Availability depends on the selected deployment and its services.

Signal Layer
CDR ingestion → 9-pass detection → composite risk score → subscriber profiles → solvability input
Graph Layer
FRAUDAR + Louvain + PageRank → ring registry + bridge nodes + mastermind index → Inngest jobs
Visual Layer
Configured visual analysis → selected detection results → file-integrity references → supported desktop workflows
Case Layer
Case lifecycle · evidence references · solvability workflow · prosecution tracker · configured exports
Analysis Layer
Selected event summaries · scoring workflows · configured location context · analyst review
Fusion Layer
Configured cross-domain search · AI Copilot · analyst collaboration · supported stream connectors
Platform Layer
Session validation · configured workspace access · adapter registry · billing metering · supported telemetry · event diagnostics
Frontend
Next.js 15 App RouterReact 19TypeScriptOutfit + JetBrains MonotRPCReact Query
Backend
Drizzle ORM (App DB)postgres.js (Graph DB)Supabase PostgreSQLInngest JobsSSE StreamingAPI Routes
AI / ML
Multi-Model EngineClaude Sonnet (Anthropic)Groq LLaMAGemini ProYOLO via RunPodONNX On-Device
Caching
Upstash Redis30s TTL + SWRTag InvalidationIn-Process CacheData Version Tokens
Security
Session ValidationRole-Based AccessWorkspace ScopingStructured DiagnosticsCredential Redaction
Research References
INTERPOL INSIGHT researchFBI Clearance StudiesUK Home Office 2013KDD 2016 FRAUDARPMC Forensic 2023
Product information

Ready to Close
More Cases?

Request a demo or access the platform directly. Our team is ready to onboard your agency within 48 hours.

Access Platform →Schedule a Demo
◆Session verification◆Role-based access◆Structured diagnostics◆File integrity references◆Configured offline workflows