Cross-case entity profiling, link analysis graph visualization, automated intelligence correlation & watchlist management for investigations.
The Law Enforcement Intelligence Module transforms the Investigation Management System (IMS) into a full-featured intelligence platform. It enables investigators to build comprehensive entity profiles, map relationships visually, discover hidden connections across cases, and prioritize high-risk subjects — all within StrataGRC.
Central repository for persons, vehicles, phones, addresses, organizations, and devices — each with identifiers, aliases, case involvement, and risk scoring.
Interactive graph visualization of entity relationships with type-based coloring, strength-weighted edges, depth expansion, and click-to-inspect.
Automated cross-case correlation engine that matches entities across investigations by shared identifiers, aliases, and name similarity.
Risk-tiered watchlist with critical/high/medium/low levels, auto-generated alerts on additions, and clearance tracking.
A suspect's phone number appears in three separate fraud investigations. The intel scanner detects the shared identifier across cases and generates an alert, enabling investigators to consolidate efforts.
An investigator builds a relationship graph around a target, revealing connections to vehicles, co-conspirators, and addresses across 5 different cases, exposing the full network.
A known fraudster is placed on the watchlist at critical risk. When any new investigation links to that entity, an intelligence alert is triggered for immediate review.
An analyst views a suspect's profile showing all identifiers (phone, BVN, NIN, email), aliases, linked cases with roles, relationship map, and activity timeline in one place.
Management reviews the LE dashboard for entity type breakdown, watchlist counts, active alerts, and most-referenced entities to deploy resources effectively.
A vehicle plate number identified at a crime scene is entered as an entity, linked to its registered owner, and the graph reveals all known associates of the owner across cases.
The geospatial module plots entity locations on an interactive map with OpenStreetMap tiles. Add locations with latitude/longitude coordinates and type (home, work, last seen, crime scene, meeting point). The map supports marker clustering for large datasets, heatmap toggling for density analysis, and per-entity-type color coding (blue for persons, orange for vehicles, green for phones, red for addresses).
Filter the map by entity to trace movement patterns or view all entities simultaneously. Each marker shows entity name, location type, address, and date recorded in a popup.
Import call detail records via CSV upload with columns for caller number, receiver number, call type (incoming/outgoing/missed/sms), call date, and duration. The module generates a call frequency chart by hour, top contacts table, and statistics dashboard showing total records, incoming/outgoing/SMS breakdown, total duration, and average call length.
Phone entities can be linked to CDR records, and the data is accessible from the entity dossier tab.
Import financial transaction data via CSV. The module auto-flags transactions above a configurable threshold for review. Visualize money flow paths with proportional bars showing top movement routes, and view monthly inflow/outflow charts. Summary cards show total inflow, outflow, transaction count, and flagged count.
Built-in open-source intelligence tools for phone number lookup (carrier detection, country, line type), email verification (format, MX check, free email detection), domain WHOIS resolution, and social media presence checks. Results are cached per entity for audit trail.
Each entity profile now features a tabbed dossier consolidating seven data views: Connections (relationship graph plus network gap detection), Map (all recorded locations), CDR (call records summary), Financial (money flow summary), Statements (witness statements across cases), OSINT (live lookup plus search history), and Timeline (unified chronology of all entity activity).
The network gap detection identifies entities that appear in the same investigations but have no direct relationship recorded — flagged as potential missing connections or bridges between cases.
The LE Intelligence module is available to organizations on the Enterprise plan or higher. It is accessed from the IMS dropdown menu or directly via the module's dashboard.
law_enforcement feature enabled in the plan's features arrayStart by syncing existing POI records from IMS — the setup script (setup_le_intelligence.php) automatically migrates all existing persons of interest into the entity registry and links them to their cases.
The Entity Registry is the core of the LE module. Every person, vehicle, phone, address, organization, or device of interest is stored as an entity with rich metadata.
| Type | Use Case | Typical Identifiers |
|---|---|---|
| Person | Suspects, victims, witnesses, informants | Phone, BVN, NIN, Email, SSN, Social Media |
| Vehicle | Cars, motorcycles, trucks linked to incidents | Plate Number, VIN, Engine Number |
| Phone | Mobile devices used in communications | IMEI, Phone Number, ICCID |
| Address | Locations of interest, crime scenes, residences | Full Address, GPS Coordinates |
| Organization | Companies, groups, front entities | RC Number, TIN, Address |
| Device | Computers, tablets, IoT devices | MAC Address, Serial Number, IMEI |
Each entity profile page (le_entity.php?id=X) provides a 360° view:
Identifiers are the key to cross-case matching. Supported types:
The intel scanner searches for entities that share identical identifier values across different investigations — this is the primary method for discovering cross-case connections.
The module includes Nigerian-specific identifiers: BVN (Bank Verification Number), NIN (National Identification Number), and plate number formats. These are critical for matching suspects across federal and state-level investigations.
The Link Analysis page (le_graph.php) provides a full-screen interactive graph visualization of entity relationships using the vis-network library. It allows investigators to visually explore connections between people, vehicles, phones, and organizations.
Each relationship has a strength level: Weak → Moderate → Strong → Confirmed, and a direction (directed or undirected).
The graph data is fetched via AJAX and rendered client-side. Only entities and relationships the user has permission to view are included. All access is gated by the canAccessFeature('law_enforcement') check.
The Intel Center (le_intelligence.php) serves as the command hub for all intelligence activities. It displays alerts from the cross-case scanning engine and provides tools for managing the intelligence lifecycle.
The cross-case scan engine automatically searches for connections across all investigations by checking:
Run the cross-case scan after adding new entities, identifiers, or linking entities to new cases. The scan is manual to give investigators control over when intelligence processing occurs.
Intelligence alerts are automatically generated by the scan engine and by certain user actions (e.g., adding to watchlist, creating relationships). Each alert contains:
Use the status and severity dropdown filters at the top of the alerts table to narrow down the list. Common workflows:
Click any alert title to open a detail modal showing the full description, severity, confidence score, related entities, related cases, and status update buttons. This allows analysts to take action without leaving the Intel Center.
The Watchlist (le_watchlist.php) provides centralized monitoring of high-risk entities. Watchlisted entities are highlighted throughout the module and trigger intelligence alerts.
| Level | Color | Use Case |
|---|---|---|
| Critical | Red | Immediate threat, active flight risk, violent offenders, terrorism suspects |
| High | Orange | Repeat offenders, organized crime members, high-value targets |
| Medium | Blue | Persons of interest under observation, potential associates |
| Low | Grey | Monitoring for information gathering, peripheral contacts |
There are two ways to add an entity to the watchlist:
le_watchlist.php?action=add&entity_id=X with the entity ID.When adding to the watchlist, you must provide:
When an entity is added to the watchlist, the system automatically generates an intelligence alert of type watchlist_hit with high severity and 90% confidence. This ensures that watchlist additions are always recorded and visible in the Intel Center.
The LE Intelligence Module is feature-gated at two levels:
The law_enforcement feature must be present in the subscription plan's features array (JSON). This is checked by canAccessFeature('law_enforcement').
| Plan | LE Intelligence Access |
|---|---|
| Essentials | Not available |
| Professional | Not available |
| Enterprise | Available |
| Unlimited | Available |
Users with admin permission via hasPermission('admin') can access the LE module regardless of the subscription plan feature check. This allows administrators to configure and test the module.
The LE Intelligence submenu appears under the IMS dropdown in the main navigation bar, but only for users who have access. The submenu items are:
php ims/setup_le_intelligence.php. This creates all required tables and syncs existing IMS POI records into the entity registry. The script is safe to re-run (it skips if data already exists).law_enforcement feature enabled in their subscription plan. Ensure your organization is on the Enterprise or Unlimited plan and that the feature is added to the plan's JSON features array.le_entity_cases junction table. Each link has its own role (suspect, victim, witness, POI, informant, etc.), allowing the same person to be a suspect in one case and a witness in another.