Prismatic Narrative

Overview

Prismatic Narrative transforms raw OSINT data into structured narratives and intelligence reports. It constructs timelines from disparate events, identifies causal relationships, and generates human-readable intelligence assessments with proper sourcing and confidence scoring. The gap between collected intelligence data and actionable insight is often a narrative one -- analysts need to understand not just what happened, but in what order, why, and what it means. Narrative bridges that gap, serving as the platform's primary output layer for communicating intelligence findings to human decision-makers.

The module operates on the principle that every intelligence claim must be traceable to its source data. Reports generated by Narrative include inline citations linking every assertion to the specific data points that support it, with NABLA-compliant confidence levels attached to each claim. This provenance chain means reports can withstand scrutiny in regulatory, legal, and corporate governance contexts where unsupported claims are unacceptable. The epistemic pipeline ensures that no report contains assertions that have not passed through the platform's Trinity Gate verification -- structural consistency, logical consistency, and formal necessity.

Narrative also provides timeline gap detection -- identifying periods where expected events are absent. In intelligence analysis, what did not happen can be as significant as what did. The module flags these gaps explicitly, preventing analysts from drawing conclusions based on incomplete data without acknowledging the incompleteness. This reflects the NABLA axiom that absence is informative -- a principle that distinguishes rigorous intelligence analysis from superficial reporting.

Architecture

Event Sources --> Event Collector --> Timeline Engine --> Report Generator --> Output
      |               |                 |                  |              |
  OSINT Findings  Normalization    Temporal Order      Template Engine  HTML/PDF
  Entity Changes  Deduplication    Causal Inference    Citation Insert  Markdown
  Sensor Data     Time Alignment   Gap Detection       Confidence Tag   Interactive
  Compliance      Entity Tag       Pattern Match       Classification   Archive

Narrative is structured as a three-stage pipeline. The Event Collector aggregates timestamped events from across the platform -- OSINT findings, entity changes, sensor readings, compliance events -- into a unified event store backed by PostgreSQL. The Timeline Engine orders these events, infers causal links using temporal proximity and entity resolution co-occurrence, and identifies gaps and anomalies. The Report Generator consumes timelines and produces formatted output in multiple formats (HTML, PDF, Markdown) using configurable templates.

Each stage is implemented as a GenStage producer-consumer, providing natural backpressure when report generation falls behind event ingestion. The Elixir OTP supervision tree ensures pipeline resilience -- a failure in report formatting cannot block event collection.

Key Modules

Key Features

Timeline Construction

The timeline engine assembles events from multiple sources into a coherent temporal sequence, resolving conflicts between source timestamps and applying entity resolution to merge events about the same entity from different sources:

defmodule PrismaticNarrative.TimelineEngine do
  @spec build(list(map()), keyword()) :: {:ok, Timeline.t()} | {:error, term()}
  def build(events, opts \\ []) do
    events
    |> normalize_timestamps()
    |> resolve_entities()
    |> sort_temporal()
    |> detect_gaps(Keyword.get(opts, :gap_detection, true))
    |> infer_causality(Keyword.get(opts, :causal_inference, true))
    |> compute_confidence()
    |> build_timeline_struct()
  end

  defp detect_gaps(events, true) do
    expected_intervals = compute_expected_intervals(events)

    gaps = Enum.flat_map(expected_intervals, fn {entity, intervals} ->
      Enum.filter(intervals, fn interval ->
        gap_significance(interval) > @gap_threshold
      end)
      |> Enum.map(&%Gap{entity: entity, from: &1.from, to: &1.to, significance: gap_significance(&1)})
    end)

    {events, gaps}
  end

  defp detect_gaps(events, false), do: {events, []}
end

• Multi-source event correlation and temporal ordering with sub-second precision
• Causal relationship inference using entity co-occurrence and temporal proximity heuristics
• Gap detection identifying missing events in expected sequences with significance scoring
• Parallel timeline tracking for multiple entities with intersection highlighting

Report Generation

Reports follow industry-standard intelligence reporting formats with full provenance chains:

• Structured intelligence report templates following industry-standard formats (SALUTE, INTREP)
• Automatic source citation with inline references linked to source data records and audit trail
• Confidence level annotation using NABLA-compliant epistemic scoring on every claim
• Multi-format output including HTML for LiveView dashboards, PDF for distribution, and Markdown for archives

Narrative Analysis

• Key event identification and prioritization based on entity significance and novelty
• Actor motivation inference from behavioral pattern matching analysis across timelines
• Pattern recognition across narratives identifying recurring operational signatures
• Predictive narrative trajectory estimating likely next events based on historical patterns

Compliance and Evidence

• GDPR-compliant report generation with automatic PII redaction where required
• Evidence chain preservation from source data through analysis to final report assertion
• NIS2 incident reporting template support for mandatory disclosure timelines
• Export formats compatible with regulatory submission requirements and legal proceedings

Citation and Provenance System

Every assertion in a generated report is linked to its supporting evidence through a citation system that maintains the full provenance chain:

defmodule PrismaticNarrative.CitationManager do
  @spec attach_citations(list(Assertion.t()), list(Evidence.t())) :: list(CitedAssertion.t())
  def attach_citations(assertions, evidence_pool) do
    Enum.map(assertions, fn assertion ->
      supporting = find_supporting_evidence(assertion, evidence_pool)

      %CitedAssertion{
        text: assertion.text,
        confidence: compute_confidence(supporting),
        citations: Enum.map(supporting, &format_citation/1),
        provenance_chain: build_provenance_chain(supporting),
        trinity_gate_status: verify_assertion(assertion, supporting)
      }
    end)
  end

  defp compute_confidence(evidence) do
    case length(evidence) do
      0 -> 0.0
      1 -> min(0.6, hd(evidence).source_confidence)
      n -> min(0.95, Enum.sum(Enum.map(evidence, & &1.source_confidence)) / n * 1.1)
    end
  end
end

Usage

# Build a timeline for an entity from collected events
{:ok, timeline} = PrismaticNarrative.build_timeline(
  entity: "example.com",
  events: collected_events,
  from: ~D[2025-01-01],
  to: ~D[2025-12-31],
  gap_detection: true)

# Generate a structured intelligence report
{:ok, report} = PrismaticNarrative.generate_report(
  subject: "Entity Risk Assessment - Example Corp",
  data: intelligence_data,
  format: :pdf,
  template: :risk_assessment,
  classification: :internal)

# Detect narrative patterns across multiple entities
{:ok, patterns} = PrismaticNarrative.detect_patterns(
  entities: ["entity_a", "entity_b", "entity_c"],
  pattern_types: [:temporal_correlation, :behavioral_similarity])

# Export timeline as interactive HTML visualization
{:ok, html} = PrismaticNarrative.export_timeline(timeline, format: :interactive_html)

# Generate NIS2 incident report
{:ok, incident_report} = PrismaticNarrative.generate_report(
  subject: "NIS2 Incident Report - Data Breach",
  data: incident_data,
  format: :pdf,
  template: :nis2_incident,
  classification: :confidential)

NABLA Compliance

Testing

Event collector tests verify multi-source aggregation, timestamp normalization, and deduplication across known fixture datasets. Timeline engine tests verify temporal ordering correctness, causal inference accuracy against labeled relationship datasets, and gap detection completeness. Report generator tests verify template rendering, citation accuracy, and format output correctness for HTML, PDF, and Markdown outputs.

Integration tests exercise the full pipeline from event ingestion through timeline construction to formatted report output, verifying provenance chain integrity end-to-end. Property-based tests generate random event sequences to verify timeline ordering invariants and gap detection stability.

Integration Points

Performance

Telemetry events: [:prismatic, :narrative, :timeline_built], [:prismatic, :narrative, :report_generated], [:prismatic, :narrative, :gap_detected].

Related Resources

• Prismatic CER -- Stores generated reports as compliance evidence with audit trail
• Prismatic Influence -- Campaign events feed into narrative timelines
• Prismatic Property Intelligence -- Property transaction events for timeline construction
• Prismatic Deduction -- Inference results provide causal relationship context
• Evidence Enforcement Agent -- Validates that every report assertion has sufficient evidentiary backing
• Elixir Architect -- Reviews GenStage pipeline architecture for OTP compliance
• Intelligence Synthesis -- Multi-source event fusion forming the foundation for narrative construction
• Trinity Gate -- Report assertions validated through structural and logical consistency gates
• Nabla Axioms -- Gap detection implements the absence-is-informative axiom in practice

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator