Intelligence

Purpose

Intelligence is the triage and investigation workspace — the desk where raw detections are reviewed, enriched with evidence, classified (or reclassified), and either dismissed as noise or promoted into actionable incidents. If Detections is "everything we've ever found," Intelligence is "what we still need to make a decision on."

Why triage matters

Automated collection casts a wide net by design — it's better to catch a false positive than miss a real phishing site. That means a meaningful fraction of raw findings are irrelevant (coincidental name matches, expired or parked domains, dormant social accounts). Intelligence is where humans and AI work together to separate signal from noise so that Mitigation only spends effort on real threats.

Core concepts

• Classification — every detection is tagged with a type (e.g. phishing domain, fake social profile, rogue app, counterfeit listing, leaked credentials, scam page, brand-abusing ad) and a severity/priority.
• AI-assisted triage (AI Sentinel) — an AI layer pre-screens findings, suggests a classification, and can auto-dismiss clearly irrelevant results, reducing analyst workload substantially.
• Investigation view — a detail pane showing evidence (screenshots, page content, WHOIS/hosting info, social metadata, seller info), related detections, and available actions.
• Promotion — turning a validated detection into an Incident, which is the unit that gets mitigated/taken down.
• Dismissal with reason — rejecting a detection as not actionable, with a structured reason code (e.g. "not brand-related," "already expired," "duplicate," "low impact — monitor only").

Workflow

flowchart TD
    A[New Detection] --> B{AI Sentinel<br/>pre-classification}
    B -->|High confidence noise| C[Auto-dismiss]
    B -->|Needs review| D[Analyst opens Investigation]
    D --> E[Review evidence:<br/>screenshots, WHOIS,<br/>hosting, social metadata]
    E --> F{Analyst decision}
    F -->|Not a real threat| G[Dismiss<br/>+ reason code]
    F -->|Confirmed threat| H[Set/confirm classification<br/>+ severity]
    H --> I[Promote to Incident]
    I --> J[Goes to Mitigation]
    G --> K[Moves to Bin]

A day in the life of an analyst

gantt
    title Example Analyst Day — Intelligence Queue
    dateFormat  HH:mm
    axisFormat  %H:%M
    section Morning
    Review overnight high-severity items :done, a1, 09:00, 30m
    Work Intelligence queue (batch 1)     :active, a2, 09:30, 90m
    section Midday
    Deep investigation on escalated item  : a3, 11:00, 45m
    Team sync on active incidents         : a4, 11:45, 30m
    section Afternoon
    Work Intelligence queue (batch 2)     : a5, 13:30, 90m
    Reclassification review               : a6, 15:00, 30m
    Dashboard/report check                : a7, 15:30, 20m

Key UI elements

• IntelligenceTable — the main list of detections awaiting triage, with columns for classification, severity, platform/hosting provider, primary identifier (domain/handle/app name), and age.
• ThreatDetailPane / ThreatActions — per-item detail view with the available next actions (classify, dismiss with reason, promote, assign to a teammate).
• Reclassification — analysts can change a detection's category later if new evidence changes the assessment; a warning modal confirms this since it can affect reporting and score history.

Common classification decision matrix

Typical use

• Work the Intelligence queue daily to keep the backlog of unclassified detections low — a stale queue directly delays Mitigation.
• Use dismissal reason codes consistently; they improve the AI Sentinel's future pre-screening accuracy and keep reporting clean.
• Promote only detections you intend to actively mitigate; low-severity, no-action items can stay classified but unpromoted (monitor-only).
• Reclassify promptly when new evidence changes the picture — this keeps score and reporting accurate.