Intelligence Synthesis

Overview

Intelligence Synthesis is the platform capability for aggregating, correlating, and synthesizing intelligence from multiple sources across OSINT, security, and business domains. It transforms raw data into actionable intelligence through the NABLA Infinity epistemic framework. Every synthesized intelligence product carries provenance metadata, confidence scores, and temporal validity markers, ensuring consumers can assess reliability without independently re-evaluating source material.

The synthesis pipeline processes data from 121+ OSINT sources, applying Signal Plurality requirements, Contradiction Preservation protocols, and multi-layer verification before any finding achieves "verified" status. This approach eliminates the common intelligence analysis failure mode of premature convergence on a single narrative.

Intelligence synthesis is not data aggregation. Aggregation collects; synthesis reasons. The platform does not simply merge data from multiple sources into a combined dataset. It resolves entity identities across heterogeneous schemas, detects contradictions between sources, preserves conflicting signals for consumer evaluation, scores confidence based on source reliability and corroboration, and validates conclusions through the Trinity Gate verification pipeline. The result is intelligence that is traceable, calibrated, and epistemically sound.

Synthesis Pipeline Architecture

The synthesis pipeline operates as a series of independent OTP processes connected by message passing, with backpressure management ensuring graceful degradation under high load.

Sources --> Collection --> Normalization --> Correlation --> Synthesis --> Verification --> Reports
  |            |              |                |              |              |
 121+       Adapters       Schema          Pattern       Confidence     Trinity
 OSINT      Extract       Mapping         Matching       Scoring         Gate

Each stage operates as an independent OTP process with backpressure management, ensuring the pipeline degrades gracefully under high load rather than dropping data or producing incomplete assessments.

Stage Details

Source Coverage

The platform collects from 121+ sources organized into five intelligence domains, each with domain-specific adapters that handle authentication, rate limiting, schema mapping, and error recovery.

Each source adapter implements a common behavior contract defined by the AIAD Standard, ensuring consistent error handling, rate limiting, and telemetry across all 121+ sources.

Entity Resolution

Entity resolution links records from different sources that refer to the same real-world entity. This is the foundational capability that makes multi-source synthesis possible -- without reliable entity resolution, cross-source correlation produces false positives and misattributions.

defmodule PrismaticOsint.EntityResolver do
  @moduledoc """
  Multi-strategy entity resolution across heterogeneous OSINT sources.
  Combines deterministic, fuzzy, network-based, and temporal methods
  for high-confidence entity linking.
  """

  @spec resolve(list(source_record())) :: {:ok, unified_entity()} | {:error, term()}
  def resolve(source_records) when length(source_records) >= 2 do
    candidates =
      source_records
      |> apply_deterministic_matching()
      |> apply_fuzzy_matching()
      |> apply_network_matching()
      |> apply_temporal_matching()
      |> score_candidates()

    case select_best_match(candidates) do
      {:ok, match} when match.confidence >= 0.85 ->
        unified = build_unified_entity(match, source_records)
        {:ok, unified}

      {:ok, match} ->
        {:ok, %{unified_entity: build_unified_entity(match, source_records),
                 confidence_warning: :below_threshold,
                 score: match.confidence}}

      :no_match ->
        {:error, :no_reliable_match}
    end
  end

  defp apply_deterministic_matching(records) do
    # Exact identifier matching: ICO, DUNS, LEI, VAT number
    Enum.group_by(records, fn r ->
      r.identifiers
      |> Enum.filter(& &1.type in [:ico, :duns, :lei, :vat])
      |> Enum.map(& &1.value)
    end)
  end
end

Resolution Methods

Belief Graph Construction

The Belief Graph represents synthesized intelligence as a directed acyclic graph where nodes are claims and edges represent evidential support or contradiction. This structure enables consumers to trace any conclusion back to its supporting evidence and evaluate the strength of the reasoning chain.

Claim: "Entity X is high risk"
  |
  +-- Evidence 1: Sanctions list match (confidence: 0.92, source: EU)
  |     +-- Sub-evidence: Name similarity 0.97
  |     +-- Sub-evidence: Country match
  |
  +-- Evidence 2: Financial anomaly (confidence: 0.78, source: AML scan)
  |     +-- Sub-evidence: Unusual transaction pattern
  |
  +-- Contradiction: Clean compliance record (confidence: 0.85, source: local registry)
        +-- Sub-evidence: No enforcement actions
        +-- Sub-evidence: Active business license

The belief graph preserves contradictions rather than resolving them, following the Addiction Preservation doctrine. Consumers receive the full evidence picture with calibrated confidence scores. This approach is critical for regulatory compliance contexts where premature resolution of ambiguity can lead to both false positives (over-blocking legitimate entities) and false negatives (missing genuine risks).

Confidence Framework

Intelligence synthesis follows all 7 NABLA Axioms with strict enforcement.

Confidence Scoring Model

Confidence scoring combines source reliability, evidence strength, and temporal relevance into a calibrated score.

defmodule PrismaticOsint.ConfidenceScorer do
  @moduledoc """
  NABLA-compliant confidence scoring for synthesized intelligence.
  Combines source reliability, evidence count, corroboration, and time decay.
  """

  @spec score(list(evidence())) :: confidence_score()
  def score(evidence_list) do
    source_reliability = calculate_source_reliability(evidence_list)
    evidence_count = length(evidence_list)
    corroboration = calculate_corroboration_factor(evidence_list)
    time_decay = calculate_time_decay(evidence_list)

    raw_score = source_reliability * corroboration * time_decay *
                :math.log(evidence_count + 1) / :math.log(10)

    # Normalize to [0.0, 1.0] range
    normalized = min(raw_score, 1.0)

    %{
      score: normalized,
      components: %{
        source_reliability: source_reliability,
        evidence_count: evidence_count,
        corroboration: corroboration,
        time_decay: time_decay
      },
      timestamp: DateTime.utc_now()
    }
  end

  defp calculate_time_decay(evidence_list) do
    half_life_hours = 720  # 30 days
    Enum.map(evidence_list, fn e ->
      age_hours = DateTime.diff(DateTime.utc_now(), e.timestamp, :hour)
      :math.exp(-age_hours / half_life_hours)
    end)
    |> Enum.max()
  end
end

Confidence Level Interpretation

Verification Pipeline

All synthesized intelligence passes through Trinity Gate verification before achieving "verified" status.

Agent Infrastructure

Intelligence synthesis is executed by 62+ specialized OSINT agents organized by domain, each operating under AIAD Standard specifications with full AIAD Compliance.

Performance and Metrics

Integration

• Validated through Trinity Gate 4-layer verification for all intelligence products
• Governed by NABLA Axioms epistemic framework for all belief formation
• Enforces NO DOUBTS evidence standards for all assessments
• Quality enforced by NO MERCY zero-tolerance standards
• Agent specifications defined by AIAD Standard with OSINT-specific capability declarations
• Compliance verified by AIAD Compliance for all 62+ OSINT agents
• Fed by Real-Time Monitoring for operational intelligence
• Tracked through Telemetry Integration for pipeline performance
• Supports Multi-Paradigm Solving with domain-specific analytical outputs
• Security validated by Color Teams for pipeline integrity
• Pipeline quality maintained by Autonomous Self-Healing
• Quality Gates enforced at every synthesis pipeline stage
• Cross-Domain Flexibility enables multi-domain investigation workflows
• Supports EASM with external attack surface intelligence
• Supports Compliance with regulatory assessment data

Connect & Contribute

Created by Tomáš Korcak (korczis) | Open Source under GHL

• GitHub | GitLab | LinkedIn | Contact
• Developer Portal | Architecture | Meet the Creator