From Investigation — to Published Report

The Scenario

Working scenario: Produce a 30-day activity brief for a conflict battlespace — Your team lead has asked you to document activity trends for a conflict battlespace over the past month and publish a brief that external stakeholders can access via a link — without requiring a Krataxis login. By the end of this tutorial you will have a published report with a shareable URL.

You do not need this exact scenario to follow the tutorial. Any battlespace with a reasonable number of observations will work. The steps and what to look for are the same regardless of the data.

Before You Start

Make sure the following are in place before you begin.

Don't have a battlespace yet? You can still follow Phase 1 and Phase 2 of this tutorial using a workbench-wide scope (leave the Workspace field blank). Generate and publish steps require at least one observation in the date range.

The Two Screens

The Analytics Engine lives across two screens. You will move between them during this tutorial.

Analytics Dashboard — /analytics

The standing picture. Pre-built panels showing key metrics, trends, spatial patterns, and data quality for a chosen scope. Zero configuration required. Use it to orient yourself before deciding whether the data warrants a deeper look.

Investigation Workbench — /analytics/workbench

Where investigations happen. A live canvas of cross-filtered tiles. Load a frame once; all filtering and exploration runs client-side at interactive speed. Everything you do is documented in an investigation thread that becomes the basis for a report.

The typical flow is: Dashboard first to orient, then Workbench to investigate, then Reports to generate and publish. This tutorial follows that exact path.

Phase 1 — Orient

In Phase 1 you open the dashboard, set the scope, and read the standing picture until you identify something worth investigating.

Step 1 — Open the Analytics Dashboard

There are several ways to reach the dashboard. Choose whichever suits where you are in the platform.

Coming from the Stats Panel? Use the Open in Analytics Workbench → link. It pre-fills the current battlespace and a 30-day window so you can skip most of Step 2.

Step 2 — Set Your Scope

The scope bar across the top of the dashboard controls what every panel shows. Set it before reading any of the panels.

1. Choose a workbench — Select Conflict, Health, or Disaster from the Workbench dropdown. Each uses the same statistical engine but maps its own entity types. For this scenario, select Conflict.

2. Choose a workspace (optional but recommended) — pick a battlespace from the Workspace selector. This restricts all panels to a single workspace so you are not looking at aggregated data across battlespaces you happen to belong to. Leave it unset for a workbench-wide view.

3. Set the date range — Set From and To dates. For a 30-day window ending today, set From to 30 days ago and To to today. Narrower windows load faster; wider windows give more meaningful trends but may hit the 100,000-observation truncation limit.

4. Click Refresh — Click the ↺ Refresh button. All seven panels load in parallel — a spinner appears in the button while they compute. Fast panels (Overview, Categories) appear within a second; slower panels (Spatial, Forecast) fill in shortly after.

Dashboard URLs are shareable. The scope bar is URL-synced. After setting your scope, copy the address bar — anyone with access can open the same view.

Step 3 — Read the Summary Cards

Four headline cards sit at the top of the dashboard. Read them first — they tell you whether the data is worth investigating before you look at a single chart.

Scroll down to the Temporal Chart. Red triangles mark surge events — days where activity significantly exceeded the rolling baseline. If you see one, that is your signal.

Step 4 — Identify the Signal

The goal of Phase 1 is to arrive at a question: something in this data is worth investigating. Common signals to look for:

Temporal surge or lull

A red triangle in the Temporal Chart marks a day where activity significantly exceeded the rolling baseline. A blue marker indicates an unusual lull. Either is a starting point.

Category dominance

A single category accounting for over 50% of all observations in the Category Mix panel, especially if that was not the case in a prior period.

Spatial concentration

High Moran's I (clustered) combined with a narrow standard deviational ellipse in the Spatial Panel suggests activity concentrated in a tight geographic area.

Low data confidence

A DCI below 60 is itself a finding — it tells you this scope has significant data gaps that need to be disclosed in any report you produce.

Once you have identified a signal — or simply confirmed that the data is worth summarising — you are ready to move to the Workbench.

No obvious signal? That is a finding too. A stable, low-DCI scope with no surges and clustered spatial distribution is a meaningful status assessment. You can still generate a Snapshot or Brief report documenting the absence of unusual activity.

Phase 2 — Investigate

In Phase 2 you move into the Investigation Workbench, load the data frame, build a canvas of cross-filtered tiles, and narrow the signal until you have something specific to document.

Step 5 — Enter the Workbench

The fastest way to enter the Workbench with your scope already applied is to use one of the Explore in Workbench → links on the dashboard. Click the one on whichever panel most directly relates to your signal — the Temporal Chart link is the most useful starting point for surge-based investigations.

Clicking any of these links opens /analytics/workbench with the same workbench, workspace, and date range pre-filled in the Workbench scope bar. You do not need to re-enter anything.

Alternatively, navigate directly to /analytics/workbench and type the scope values manually. The Workbench scope bar works identically to the dashboard scope bar.

Step 6 — Load the Frame

The Workbench operates differently from the dashboard. Instead of making many small API calls, it makes one call that ships the entire filtered dataset to your browser as a compact columnar structure — the frame. Once loaded, all filtering, pivoting, and exploration runs client-side with no further server round-trips.

1. Confirm the scope — Check that the Workbench, Workspace, From, and To fields are set correctly in the scope bar. The frame you load is exactly the data matching this scope.

2. Click Load Frame — Click the Load Frame button. A progress indicator appears while the server resolves and encodes the observations. For a 30-day scope on a moderately active battlespace, this typically takes under two seconds.

3. Check the frame summary — Once loaded, a summary row appears below the scope bar: total observations, date span covered, and whether the frame is complete or truncated. If you see a truncation warning, narrow your date range. Truncation threshold: frames over 100,000 observations are automatically truncated. The full analytical picture is preserved for narrower scopes.

Reloading the frame discards cross-filters. Any selections you have made on tiles are cleared when you load a new frame. Build your canvas and make your initial tile selections before deciding to reload.

Step 7 — Build the Canvas

The canvas is a two-column grid of tiles. Each tile visualises a different view of the frame. Start with three tiles — Timeline, Distribution, and Map — which together let you see when, what, and where the signal is coming from.

1. Open the Add Tile menu — Click + Add Tile in the left tools panel (or the toolbar above the canvas). A picker shows all available tile types.

2. Add a Timeline tile — Select Timeline. A daily histogram of observation counts appears. Bar colour reflects mean magnitude. This is your primary view for spotting surges and lulls.

3. Add a Distribution tile — Select Distribution. By default it shows the top categories. Use the ⚙ tile settings to switch to Entity Type, Source, Day of Week, or Hour of Day if those views are more relevant to your signal.

4. Add a Map tile — Select Map. Geolocated observations appear as a scatter plot coloured by magnitude. Non-geolocated observations do not appear on the Map tile but are still included in the frame and in all other tiles.

5. Optionally add a Stat tile — A Stat tile shows a live descriptive summary of whatever is currently selected: count, percentage of total, mean/median magnitude, mean confidence, and top category. It is especially useful as a running readout while you cross-filter.

Tiles can be reordered by dragging the ⠿ handle in the tile header. Remove a tile with the ✕ button. The canvas layout is saved to local storage — your tiles will be restored on your next visit.

Keep it focused. Three or four tiles is usually enough for an investigation. More tiles create visual noise and can slow down cross-filter renders on large frames.

Step 8 — Cross-Filter to Narrow the Signal

Cross-filtering is how you investigate. A selection on any tile immediately filters every other tile — all client-side, with no loading delay.

1. Brush a date range on the Timeline — Click and drag across the Timeline tile to select a date range — for example, the days around a surge marker. All other tiles immediately narrow to show only the observations from that period. The Stat tile (if you added one) updates to show the count and statistics for the selection.

2. Click a category bar on the Distribution tile — With a date range already selected, click a bar in the Distribution tile to further narrow to a specific category. The Map tile now shows only geolocated observations that fall within that date range AND that category.

3. Draw a map rectangle (optional) — On the Map tile, drag to draw a rectangle around a geographic area of interest. The Timeline and Distribution tiles update to show only the observations inside that bounding box.

4. Clear the selection to reset — Click an empty area on any tile, or click the Clear selection button in the toolbar. All tiles return to the full frame.

The goal is to narrow from the full frame to a meaningful subset — the specific days, categories, or geographic area that constitutes your signal. Once you have it isolated, you are ready to document what you found.

Phase 3 — Document

In Phase 3 you record what you found in the Investigation Thread, articulate hypotheses, and save the investigation before generating a report.

Step 9 — Pin Selections to the Thread

The Investigation Thread sits below the canvas. It is a chronological record of your analytical steps. Pinning a selection adds a snapshot of your current cross-filter state — which tiles you have selected, and on what values — as a step in the thread.

1. Make a meaningful selection on the canvas — Cross-filter to the signal you want to document — for example, brush the five-day surge period on the Timeline, then click the dominant category in the Distribution tile.

2. Click Pin current selection — In the Thread Panel header (below the canvas), click Pin current selection. A new step appears in the thread showing the selection summary: date range, active filters, observation count, and mean confidence.

3. Repeat for each distinct finding — Adjust the cross-filters, then pin again. Build up a sequence of steps that traces your analytical path — from the full frame down through progressively narrower selections. The thread becomes a reproducible record of how you arrived at your conclusions.

Step 10 — Add Notes and Mark Findings

Not everything worth recording is a data selection. Notes let you add interpretive text alongside pinned steps.

1. Click + Note in the Thread Panel header — A small text area opens inline in the thread. Type your observation — for example: "Surge on 12–14 Apr corresponds with reported escalation in the northern sector. Three sources, all high confidence."

2. Click Add note — The note appears as a step in the thread at its current position. Notes have no data attached — they are interpretive text that gives context to the surrounding steps.

3. Mark a step as a Finding — Hover over any thread step and click the ★ Star icon that appears. The step is promoted to a Finding — styled differently in the thread and pulled into the Investigation Report as a highlighted conclusion. Mark the step that best captures the core conclusion of your investigation.

The thread tells a story. A good thread has 4–8 steps: an opening selection that establishes the scope, 2–3 narrowing steps that isolate the signal, a note explaining the interpretation, and a starred finding. Reports generated from this thread will structure themselves around these steps.

Step 11 — Write Your Hypotheses

The Hypothesis Panel sits below the Thread Panel. Hypotheses are the explicit claims you are testing. They are optional for a Snapshot or Brief report, but are included in full in an Investigation Report and help a reviewer understand your reasoning.

1. Click + New in the Hypothesis Panel — A composer opens. State a claim as a clear, testable sentence — for example: "The April surge correlates with the change in source confidence, not with an actual increase in ground activity."

2. Set a verdict — Once written, set a verdict on the hypothesis using the badge dropdown: Open — still being tested   Supported — evidence supports it   Refuted — evidence contradicts it   Inconclusive — insufficient data

3. Link thread steps as evidence — On each thread step, click → Hypothesis to link it as evidence for or against a hypothesis. The Hypothesis Panel shows a count of supporting and contradicting steps under each hypothesis.

Step 12 — Save the Investigation

Investigations are saved explicitly — the system does not auto-save. An amber unsaved changes badge appears in the investigation bar whenever there are unsaved changes.

1. Click Save in the thread panel header — The button reads Save when there are unsaved changes and shows a spinner briefly while writing. Each save creates a snapshot of the investigation state. You cannot lose earlier versions — previous snapshots are accessible from the investigation menu if you need to recover an earlier state.

2. Give the investigation a name (first save only) — On the first save, a prompt asks for an investigation name. Choose something specific — for example: "April Surge Analysis — Ukraine Conflict". The name appears in the investigation selector when you or a teammate opens saved investigations.

3. Set sharing if others need to review it — Open the investigation menu (gear icon in the investigation bar) → Sharing. Set to Workspace so workspace members can view it, or Team for platform-wide access. Leave it Private if no review is needed before generating the report.

Phase 4 — Publish

In Phase 4 you generate the report, have it approved, publish it, and share the link. The full workflow is:

The report captures the current scope. If you want the report to cover the same scope you just investigated, generate it from the Workbench Reports tab (not the Dashboard tab) while the scope bar still shows your investigation's scope. The scope is baked into the report at generation time.

Step 14 — Review the Report

Before requesting approval, download the report and read it. Reports that go out without review risk containing misleading statistics, missing context, or scope errors.

1. Download as HTML — Find the report row in the Recent Reports list. Click ↓ HTML. A self-contained file opens in your browser — inline SVG charts, no external dependencies. This is the fastest format to read.

2. Check the scope header — Every report includes a scope statement at the top: workbench, workspace, and date range. Confirm these match your intent. A report scoped to the wrong battlespace or wrong date range should be deleted and regenerated.

3. Read the statistical sections — Check that the numbers match what you saw in the Workbench. Look for any statistics that seem implausible — very high Moran's I on a near-empty frame, or a trend line that contradicts the chart. If anything looks wrong, regenerate after adjusting the scope.

4. Confirm no sensitive details are included — Reports that will be published publicly must not contain internal UUIDs, battlespace names that are classified, source handles, or any information not cleared for external sharing. The platform strips internal IDs automatically, but source names and battlespace descriptions come from your data.

Step 15 — Get the Report Approved

Approval is a deliberate gate. No report can be published until it has been approved by a workspace owner or platform administrator. The purpose is to ensure intelligence products that leave the platform have had at least one review step.

1. Find the report in the Recent Reports list — Each report row shows its status. A report pending approval shows an Approve button. This button is only visible to users with the workspace Owner role or platform Admin role.

2. If you are not the approver: share the report — Notify your workspace owner that a report is pending approval. They can find it in the Reports tab with the same workbench and workspace scope. There is no in-app notification for pending approvals at this time — use your team's usual communication channel.

3. Approver: click Approve — Click the Approve button on the report row. A Approved ✓ badge appears. The report is now eligible for publishing. The action is logged in the platform audit trail.

If you are the workspace owner: you can approve your own reports. The Approve button is visible to you on your own report rows. This is intentional — solo analysts leading a workspace should not be blocked from publishing.

Step 16 — Publish and Share

Once approved, the report card expands to show the publishing controls.

1. Choose visibility — Two options: Public — anyone with the link: the report page is accessible without a Krataxis login. Use this for external stakeholders who do not have platform accounts. Workspace — members only: the report page requires the viewer to be logged in and a member of the linked battlespace. Use this for internal sharing without full public exposure.

2. Click Publish → — The server mints a secure public token and freezes the report snapshot. A public link appears in the format /r/{token}. The token is a random opaque string — it does not contain any internal IDs or battlespace identifiers.

3. Copy the link and share it — Click 📋 Copy next to the public URL. Paste it wherever your stakeholders will receive it — email, a briefing document, a messaging channel. Recipients can open the link in any browser without a login (for Public visibility).

Publishing is audited. Every publish and unpublish action is written to the platform audit log with the acting user, timestamp, and report UUID. If a report needs to be taken down urgently, click Unpublish — the link returns a 404 immediately.

Managing a Published Report

After publishing, three management actions are available on the report card:

Step 17 — Monitor for Drift

Krataxis data is continuously re-ingested and re-scored. A published report is frozen at publish time — it will not silently change as the underlying data evolves. But the Drift Detection system re-runs the report's original scope against live data daily and tells you if anything has changed.

The drift state appears as a badge on the published report card, and as a banner at the top of the public report page:

The snapshot principle. A published report is an immutable record of what the data showed at publish time. Drift detection does not alter the report — it reports the discrepancy honestly. An analyst who states "87 strikes were recorded in January" should not find that number has silently changed months later. If the data changed, Republish creates a new version and leaves a trace.

Congratulations — you have completed the full workflow. The report is published, the link is shareable, and the drift detector will alert you if the underlying data changes in a way that affects the published finding.

Template Guide

Choosing the right template matters. Use this guide to match your analytical goal to the report format.

For routine situation reporting, use Brief. For deep investigations that need to show your reasoning, use Investigation. Everything else is for specific analytical questions — spatial when geography matters, Comparative when you are measuring change, Dossier when completeness matters more than brevity.

What's Next

You have completed the core workflow. Here are a few directions to explore next.

Derived fields

Create computed columns from the frame data — ratios, time-since, rolling averages — and use them as tile dimensions. Available in the left tools panel under Derived Fields.

Compound filters

Apply persistent named filters to the frame before cross-filtering begins — for example, restrict to a single source tier or a confidence band. These carry through into the generated report.

Statistical tests

Run Mann-Whitney, two-proportion z-test, or chi-square tests against the current selection versus the remainder of the frame. Results can be pinned to the thread as a test step.

Full analyst manual

The complete feature reference — covering all tile types, the formula language, statistical test interpretation, performance guidance, and a statistics glossary — is in the Investigation Workbench — Analyst Manual.