Event / Incident: Data Point Intelligence Guide

An event is where every other data point converges: a time, a place, a set of actors, and the messy question of what actually happened.

Understanding the Event / Incident as an intelligence artifact

An event data point is a discrete, bounded real-world occurrence recorded with a timestamp, a location, participating actors and a type: a protest, armed clash, strike, arrest, seizure, outage, breach disclosure or industrial accident. In structured datasets it is a row with fields for date, geocoded coordinates, actor names, category, impact measures and source citations. The event is the unit at which trends are measured, so the coding rules behind it determine what any resulting analysis can legitimately claim.

Variants matter. Coded datasets apply strict inclusion criteria and controlled actor taxonomies, whereas incident feeds and news aggregations do not. Some datasets record one row per report, producing duplicates; others deduplicate into a single event carrying multiple sources. Precision fields for geography, date and source scale are the difference between a mappable coordinate and a country centroid, and they are routinely ignored by downstream users.

Why it matters

Events convert scattered reporting into comparable structure that can be counted, mapped and tested against a baseline. They anchor other artifacts, so a video geolocated to the site, a flight arriving beforehand and a narrative surging afterwards all attach to one timeline. For risk teams, event history at a location drives operational decisions about staffing and movement. For investigators, the event is the frame that makes disconnected indicators legible as a single operation.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Temporal clustering of similar events, separating a coordinated campaign from independent incidents in the same period.
• Geographic concentration and displacement over time, showing whether activity is spreading, contracting or simply relocating.
• Actor combinations recorded per event, mapping alliances, rivalries and which groups operate in which territory.
• Escalation trajectory across event types, such as protest to riot to armed engagement over successive weeks.
• Day-of-week and anniversary patterns tied to pay cycles, religious observance or political commemorations.
• Source count and source diversity per event, which is a direct and usable proxy for reporting confidence.
• Lag between occurrence and first report, indicating access restrictions, connectivity loss or deliberate information control.
• Impact measures such as casualties, arrests, seizure quantity or downtime that permit severity comparison across events.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• ACLED — Coded political violence and protest events worldwide with dates, actors, locations and source notes.
• GDELT — High-volume automated event coding from global news with geolocation, useful for breadth and early warning.
• ReliefWeb and OCHA reporting — Humanitarian situation reports and disaster records with dated operational detail and named locations.
• USGS, EMSC and NASA FIRMS — Authoritative earthquake feeds and active-fire detections for corroborating physical events independently.
• Police, customs and regulator press releases — Primary records of seizures, arrests and enforcement actions with dates, quantities and jurisdictions.
• State breach notification portals — Official disclosure records for data breaches, including dates, cause and affected population counts.
• Wikidata and current events portals — Fast structured aggregation with citations, useful as a lead source rather than as evidence.
• National statistics and transport authorities — Official incident and outage records that provide a denominator for rate-based analysis.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define the event boundary — Decide explicitly what counts as one event versus several, and apply that rule consistently across the entire dataset.
2. Require independent sources — Collect at least two unrelated reports before treating an event as confirmed, recording each citation against the record.
3. Resolve time and place — Geocode to the highest defensible precision and record the precision level rather than implying accuracy you do not have.
4. Attach artifacts — Link videos, images, flight tracks, filings and posts to the event record, each carrying its own provenance metadata.
5. Code actors carefully — Use a controlled actor vocabulary and record the evidence for each attribution separately from the event facts themselves.
6. Deduplicate — Merge repeat reporting of the same occurrence while keeping every source attached so confidence can be recalculated later.
7. Compare to baseline — Assess the event against historical rates for that location and type before describing it as escalation or anomaly.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• Geospatial Intelligence — Intelligence Derived from Place
• Criminal Intelligence — Intelligence Supporting Criminal Investigation
• Human Intelligence — Information from People, Ethically Obtained
• Risk Intelligence — Structured Assessment of Threat and Consequence
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Legal Intelligence — Law, Litigation, and Regulatory Intelligence
• Threat Actor Intelligence — Tracking Adversary Groups Over Time
• Imagery Intelligence — Interpretation of Visual Imagery
• Cyber Intelligence — Adversary Activity in Networks and Systems
• News Intelligence — Media Reporting as an Intelligence Source

Investigated in these domains

• Nation State
• Ransomware
• Threat Analysis
• Critical Infrastructure
• Insider Threat
• Organized Crime
• Human Trafficking
• Wildlife Trafficking
• Gangs & Street Crime
• Kidnap, Hostage & Extortion

Pivots to these data points

• Keyword / Narrative — A search term, topic, hashtag, or narrative tracked across media and platforms.

Inside the platform: where Event / Incident lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_event — Data point hub
• threat-dashboard.php?theme=nation_state — Nation State dashboard
• ransomware.php — Ransomware dashboard
• threats.php — Threat Analysis dashboard
• domain.php?d=critinfra — Critical Infrastructure dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the event boundary is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Resolve time and place turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Compare to baseline feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Event / Incident

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Event data underpins intelligence preparation of the operating environment. Coded incident histories establish patterns of life, seasonal and diurnal activity, actor territorial control and escalation trajectories, all of which feed route planning, base siting, force protection posture and indications and warning. The discipline is baseline comparison: an incident is only escalation relative to the historical rate for that location and type. Constraints include dataset licences that restrict military and commercial use, coverage that reflects journalist presence rather than actual activity, and coding rules that differ between datasets. Products are IPB overlays, threat assessments and warning indicators, each stating the dataset, its inclusion criteria and its known reporting bias.

🕵 National intelligence

Event datasets give national intelligence a comparable, countable structure over otherwise unstructured reporting, which is what makes trend and warning analysis possible. Their value is greatest when fused: an event record anchors imagery, movement data, financial disclosures and communications reporting to one time and place. Requirements should specify the geography, actor set and event types rather than requesting everything. Handling is straightforward as open source, but coded datasets carry licence conditions that survive incorporation into classified products, so record them. Analytic writing must separate coded fact from inference and state source count per event, which is the most usable available confidence proxy.

👮 Law enforcement

For law enforcement an event record is a case anchor: a dated, located occurrence to which statements, seizures, imagery and communications attach. Evidentially, the record itself is a research artefact rather than evidence; the underlying police report, seizure record or witness statement is what is tendered. Where events are drawn from open sources, preserve the source material with hashes and record the collection method. Aggregated event history supports resourcing, public order planning and pattern evidence in organised crime and serial offending cases, where admissibility of pattern analysis requires the methodology to be documented and reproducible by an independent examiner.

🔍 Private investigation and corporate security

Corporate security uses event history for travel risk assessment, site selection, business continuity and supply chain disruption forecasting. Incident rates at a location over time drive concrete decisions about staffing, insurance and movement, and a defensible assessment cites the dataset, its inclusion criteria and its coverage limits rather than presenting a heat map as fact. Licence terms matter: several major event datasets restrict commercial use or require specific attribution, and using them in client deliverables without checking creates liability. A private actor must not present low-precision geocoded data as site-specific, which is the most common way these assessments mislead.

📰 Journalism and OSINT media

Event data supports quantified reporting, and the reporting standard is to state the dataset, its coding rules and its coverage bias in the piece. Reporting density frequently maps journalist presence and connectivity rather than actual activity, so a map of incidents is often a map of where reporters are. Verify individual events against at least two independent sources before naming them, and check whether early casualty figures were later revised, since corrections rarely propagate. Avoid publishing identifying detail about victims and detainees. Where the analysis drives a claim about a named actor, seek comment and be explicit about what coded data can and cannot attribute.

🌍 NGO, humanitarian and human rights

Humanitarian and human rights organisations use event data for early warning, needs assessment, protection monitoring and accountability documentation. Records frequently contain personal data about victims, detainees and witnesses, so minimisation and access control are protection measures rather than compliance overhead. Do-no-harm applies directly: publishing precise locations or identifying detail can expose survivors and staff to reprisal, and can put field teams at risk. Document to accountability standards where events may evidence international crimes, with source citations preserved and a clear separation between what was observed and what was inferred. Rotate and support staff coding violent incidents.

🎓 University and research

Event datasets are among the most used and most misused resources in quantitative conflict and social research. Methodology must engage explicitly with coding rules, inclusion criteria, source pools and precision fields, since combining datasets with incompatible criteria produces meaningless series. Report how you handled duplicates, low-precision geocoding and date ambiguity, because those choices drive results more than the model does. Ethics approval applies where individual-level detail is used. Reproducibility requires citing the dataset version and download date, since these datasets are revised retrospectively, and publishing the cleaning code alongside the analysis.

Playbook: working Event / Incident end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the event boundary

Decide explicitly what constitutes one event: a clash lasting three days, a protest recurring nightly, or a multi-site attack may be one record or many depending on the rule you adopt. Write the rule down and apply it consistently, because inconsistent boundaries make counts incomparable within your own dataset before any external comparison is attempted. Also define your inclusion criteria: which actors, which severity threshold, which geography. The output is a codebook that another analyst could apply to the same reporting and reach the same records.

Phase 2 — Select datasets deliberately

Choose sources on inclusion criteria and coverage rather than convenience. Coded datasets apply strict rules and controlled actor taxonomies; automated news coding gives breadth and speed with systematic error; official records give authority within one jurisdiction. Read each dataset's methodology before use, and record its licence. Never merge datasets without harmonising criteria first. The output is a documented source set with a statement of what each contributes and what each systematically misses, which becomes the caveat paragraph in every product built on it.

Phase 3 — Require independent corroboration

Treat an event as confirmed only when at least two unrelated sources report it, recording each citation against the record. Unrelated means genuinely independent, not two outlets republishing one wire report, which is the most common false corroboration. Track source count and source type per event, since this is a directly usable confidence proxy that most downstream users would value if it were surfaced. Where only a single source exists, retain the record flagged as unconfirmed rather than discarding it, since single-source events cluster in exactly the areas with least access.

Phase 4 — Resolve time and place with stated precision

Geocode to the highest defensible level and record the precision explicitly: exact site, settlement, district or country centroid. Do the same for dates: exact, within a week, within a month. Precision fields are the difference between a mappable coordinate and a phantom cluster at a country centroid, and downstream users routinely ignore them, so make them mandatory in your schema and filter on them in your own products. Where reporting gives only a region, resist the temptation to place a point at its centre without flagging it.

Phase 5 — Separate occurrence from reporting date

Record when the event happened and when it was first reported as distinct fields. The lag between them is analytically valuable: it indicates access restrictions, connectivity loss, deliberate information control or simply distance from media presence. Conflating them shifts timelines by days in fast-moving situations and creates spurious clustering around news cycles. Where the occurrence date is uncertain, record the range. The output is a dataset in which both the event series and the reporting series can be analysed separately.

Phase 6 — Deduplicate carefully

Merge repeat reporting of one occurrence into a single record while retaining every source citation, so confidence can be recalculated if a source is later discredited. Deduplication requires rules for near-matches in time, place and description, and those rules should be documented and tested. Under-deduplication inflates counts wherever an incident attracts heavy coverage, systematically overstating activity in accessible areas. Over-deduplication merges genuinely separate incidents. Sample and manually check merge decisions rather than trusting an automated similarity threshold.

Phase 7 — Code actors against a controlled vocabulary

Use a fixed actor taxonomy with recorded aliases rather than free text, and keep the evidence for each attribution in a separate field from the event facts. Groups rename, split, merge and are misidentified by reporters, and free-text actor fields make longitudinal analysis impossible within a year. Record attribution confidence separately from event confidence, since an event can be well established while the perpetrator is disputed. The output supports actor-level analysis without conflating who was reported with who was responsible.

Phase 8 — Attach artefacts and evidence

Link videos, images, satellite imagery, flight and vessel tracks, official statements, filings and posts to the event record, each carrying its own provenance metadata and hash. This is what turns a coded row into an investigable incident and what allows an accountability body to reconstruct the basis for the record years later. Preserve the artefacts rather than only linking to them, since the underlying material is routinely deleted. Record which artefacts corroborate and which contradict the coded description.

Phase 9 — Compare against baseline

Before describing anything as escalation, anomaly or improvement, compute the historical rate for that location, actor and event type, with its normal variance and seasonality. Many apparent surges are within ordinary variation or track a known annual cycle such as harvest, fighting season or election calendar. Where the baseline is thin because the area is under-reported, say so rather than treating a rise from one to three events as a two hundred percent increase, which is the standard way small-number reporting misleads.

Phase 10 — Fuse and test hypotheses

Combine the event series with other data to test explanations: does the surge correspond to a change in force disposition, a commodity price movement, an election date, a court ruling or a narrative campaign. Look for displacement rather than reduction, where activity moves rather than stops. Test the null hypothesis that the change is a reporting artefact caused by a new source entering the pool or connectivity being restored, which explains a surprising share of apparent trends.

Phase 11 — Publish with method and caveats

State the dataset, version, download date, inclusion criteria, precision filters applied, deduplication method and known coverage bias alongside every figure. Distinguish coded fact from analytic inference in the text. Apply minimisation to victim and detainee detail, and consider whether precise locations expose anyone to reprisal. Archive the underlying sources so the record remains auditable. Record the date of your extract, since major datasets revise historical records retrospectively and your numbers will not reproduce later without it.

Phase 12 — Maintain and revise

Update records as better information arrives, particularly casualty and impact figures, which are almost always wrong initially and rarely corrected downstream. Keep a revision history so that changes to the series are visible rather than silent. Re-run analyses after major dataset revisions. Schedule a retention review for records containing personal data. The measure of a mature event capability is that its historical record improves over time rather than being frozen at the moment of first coding.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
ACLED	Registration	Coded dataset of political violence, protest, riot and strategic development events with actors, dates, locations and source notes.	Primary structured event source for conflict and protest analysis with documented coding rules and precision fields.
GDELT Project	Open	Automated global event and theme coding from news media with geolocation, updated continuously across many languages.	Breadth and early warning, accepting systematic coding error, where speed matters more than precision.
Uppsala Conflict Data Program	Open	Long-running academic dataset of organised violence with strict inclusion criteria and georeferenced event data.	Authoritative long historical baselines for organised violence trends and comparative research.
ReliefWeb	Open	Humanitarian information service publishing situation reports, assessments and disaster records from operational agencies.	Corroborates events with dated operational reporting and provides impact and needs detail.
UN Office for the Coordination of Humanitarian Affairs	Open	Coordination body publishing humanitarian situation reporting, access constraints and population movement data.	Explains reporting gaps by documenting access restrictions that suppress event visibility.
USGS Earthquake Hazards Program	Open	Authoritative real-time and historical earthquake catalogue with magnitude, depth and location.	Independent physical corroboration and authoritative records for seismic events.
European-Mediterranean Seismological Centre	Open	Rapid seismic event reporting including crowd-sourced felt reports across Europe and the Mediterranean.	Faster initial seismic detection and eyewitness reports useful for early corroboration.
NASA FIRMS	Open	Near real-time active fire and thermal anomaly detections from satellite sensors with global coverage.	Independently corroborates fires, shelling impacts and industrial incidents at a claimed location and time.
Copernicus Emergency Management Service	Open	Satellite-based rapid mapping and risk products for disasters and humanitarian emergencies.	Authoritative damage extent mapping that quantifies impact independently of ground reporting.
EM-DAT international disaster database	Registration	Global database of natural and technological disasters with impact, casualty and economic loss fields.	Comparable historical baselines for disaster frequency and impact by country and hazard type.
Global Terrorism Database	Registration	Coded dataset of terrorist incidents worldwide with attack type, target, perpetrator and casualty fields.	Historical baselines and actor coding for terrorism-related event analysis.
National and state breach notification portals	Open	Official disclosure records for data breaches including dates, cause and affected population counts.	Authoritative event records for cyber incidents with dates that can be tested against vendor claims.
Wikidata and current events portals	Open	Structured aggregation of notable events with citations, updated rapidly by a large contributor base.	Fast lead generation and citation discovery, used as a pointer rather than as evidence.
Police, customs and regulator press releases	Open	Primary official records of seizures, arrests, enforcement actions and outages with quantities and dates.	Authoritative single-jurisdiction event records that anchor otherwise media-derived timelines.
IATI and humanitarian data exchange	Open	Open datasets on humanitarian operations, population movement and administrative boundaries.	Supplies denominators and administrative geographies for rate-based rather than count-based analysis.
Berkeley Protocol on Digital Open Source Investigations	Open	Methodology for collecting and preserving open source information to evidential standards.	Governs how artefacts attached to an event record are preserved for later accountability use.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Event / Incident. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• ACLED data export and API — Structured event retrieval with actor, type and precision filters. Limitation: licence restricts some commercial and governmental use and requires specific attribution.
• GDELT query interfaces — Very large automated event stream with near real-time updates. Limitation: automated coding error rates are high and actor extraction is unreliable outside major languages.
• GIS platforms — Map, cluster and analyse event geography against terrain and infrastructure. Limitation: mapping low-precision records without filtering creates convincing phantom clusters.
• Deduplication and record linkage tooling — Merges repeat reporting on time, place and description similarity. Limitation: thresholds are dataset-specific and require manual sampling to validate.
• Timeline and case management systems — Attach artefacts, sources and provenance to each event record. Limitation: only as good as the discipline of recording citations at coding time.
• Statistical baseline and anomaly detection — Distinguishes genuine deviation from ordinary variation and seasonality. Limitation: unreliable on small counts, which is where most analysts most want it.
• Satellite imagery services — Independent corroboration of damage, fire, flooding and movement at a claimed place and date. Limitation: revisit intervals and cloud cover create unavoidable gaps.
• Archiving pipelines — Preserve the source reporting and attached media behind each event. Limitation: storage and retention obligations grow quickly, particularly for graphic material.
• Actor taxonomy management — Maintains controlled vocabularies with aliases, splits and merges over time. Limitation: requires ongoing curation that is invariably under-resourced.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• Event density is a map of media access before it is a map of activity. Areas with no reporters, no connectivity or active information control show as quiet, and analysts who forget this consistently misread the safest-looking regions.
• Occurrence date and reporting date must be separate fields. Conflating them clusters events around news cycles and shifts entire timelines in exactly the fast-moving situations where timing matters most.
• Precision fields exist for a reason and are routinely ignored. Mapping country-centroid records alongside site-precise ones produces phantom hotspots that then get briefed as findings.
• Two outlets republishing one wire report is not corroboration. Independence means separate observation, and the most common failure in event verification is counting syndication as confirmation.
• Never merge datasets without harmonising inclusion criteria. Two datasets counting different things will produce a trend line that is an artefact of the merge rather than a fact about the world.
• Early casualty figures are almost always wrong and almost never corrected downstream. Record the revision history and cite the figure with its date, because the first number is the one that circulates forever.
• Test the reporting-artefact hypothesis before the substantive one. A new source entering the pool, or connectivity being restored, explains a surprising share of apparent surges and is cheap to check.
• Look for displacement rather than reduction. Activity that disappears from one district and appears in the next has not decreased, and headline totals hide this while maps make it obvious.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Event / Incident is producing anything, and they are worth baselining before you change process or tooling.

• Proportion of events in the working dataset confirmed by two genuinely independent sources, with source count recorded per record.
• Share of records carrying explicit geographic and temporal precision fields rather than implied accuracy.
• Median lag between occurrence and record creation, tracked by region to expose access and coverage constraints.
• Deduplication accuracy measured by manual sampling of merge decisions rather than assumed from a similarity threshold.
• Proportion of published trend claims accompanied by baseline comparison and stated dataset version and extract date.
• Rate at which initial impact figures are subsequently revised, and the share of revisions propagated into prior products.
• Number of event records with preserved supporting artefacts and hashes, supporting later verification or accountability use.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Reporting bias means event density often maps journalist presence and connectivity rather than the actual distribution of activity.
• One occurrence reported by many outlets inflates counts wherever deduplication is weak or entirely absent.
• Date fields may record publication rather than occurrence, shifting timelines by days in fast-moving situations.
• Country-centroid coordinates in low-precision records create phantom clusters when mapped without filtering on precision.
• Datasets use incompatible inclusion criteria, so combining them without harmonisation produces meaningless trend lines.
• Early casualty and impact figures are almost always wrong and are rarely corrected once they enter downstream citation.

Legal and ethical considerations

Event records frequently contain personal data about victims, detainees and named participants. Apply minimisation, avoid republishing identifying detail about victims and minors, and follow do-no-harm principles where publication could expose people to reprisal. Respect dataset licences, since several major event datasets restrict commercial use or require specific attribution. Preserve source citations so every downstream claim is auditable, and clearly separate coded fact from analytic inference in reporting.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Event / Incident, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 10 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

Can I combine two event datasets to get better coverage?

Only after harmonising inclusion criteria, actor taxonomies and event definitions, and usually not at all for trend analysis. Datasets count different things: one may require a fatality threshold, another may code every reported protest, and a third may include strategic developments that are not violent incidents at all. Merging without harmonisation produces series whose movements reflect the merge rather than reality. Where you need breadth, run parallel analyses on each dataset and compare conclusions, reporting where they agree and where they diverge, which is more informative than a combined number.

Why does the map show a cluster in an empty area?

Almost certainly low-precision geocoding. Records where reporting gave only a country or province are frequently placed at an administrative centroid, and mapping them alongside site-precise records creates a dense artificial cluster in an arbitrary location. Filter on the precision field before mapping, and display low-precision records as polygons or exclude them from point maps entirely. This is the most common way event maps mislead, and it is fully preventable using fields the dataset already provides.

How do I judge whether a rise is real?

Compute the historical rate for that location, actor and type with its normal variance and seasonality, then test whether the observed change exceeds it. Separately test whether the rise is a reporting artefact: did a new source enter the pool, was connectivity restored, did a dataset change its coding rules, did a major outlet start covering the area. On small counts, avoid percentage framing entirely, since a rise from one to three events is not a two hundred percent increase in any meaningful sense. State the baseline and the uncertainty alongside the claim.

What is the right unit when one attack hits multiple sites?

Whatever your codebook says, applied consistently. Both conventions are defensible: one record per coordinated operation captures intent and command, while one record per site captures geography and impact. What is not defensible is switching between them, which is what happens when coding is done by different people without a written rule. Record both where you can, using an operation identifier that links site-level records, since that supports either analysis without recoding.

How should victim information in event records be handled?

Minimise at collection, not at publication. Record what is analytically necessary, which is usually counts, categories and location rather than names, and hold identifying detail separately under access control where it is genuinely needed for accountability work. Publishing names, precise home locations or identifying circumstances can expose survivors and families to reprisal, and can breach anonymity provisions. Where a case may support accountability proceedings, preserve the full record under restricted access with a documented retention period, and share only through appropriate channels.

Are automated event feeds good enough for warning?

For breadth and speed, yes; for anything that will be briefed as a finding, no. Automated coding from news produces high volumes with systematic errors in actor identification, event classification and geolocation, and it duplicates heavily because it codes reports rather than events. Use it as a tripwire that directs human attention, then verify individual events against primary sources before they enter a product. The combination of automated breadth and manual verification is the practical arrangement; either alone fails in a predictable direction.

How do I cite event data so my analysis is reproducible?

Cite the dataset name, version or release, the extract date, the exact filters applied including precision thresholds, and the deduplication treatment. Major datasets revise historical records retrospectively, so an extract taken today will not reproduce next year without a version and date. Archive your extract alongside the analysis where the licence permits, and publish the cleaning and filtering code. Without these, a reader cannot distinguish a difference in findings caused by your method from one caused by the dataset having changed underneath you.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• ACLED and UCDP published codebooks, which define inclusion criteria, event boundaries and actor taxonomies for coded conflict data.
• Berkeley Protocol on Digital Open Source Investigations, governing preservation and analysis of artefacts attached to event records.
• Humanitarian Data Exchange and IATI standards, defining interchange formats and administrative geographies for humanitarian data.
• Do No Harm principles and humanitarian protection standards, governing minimisation and publication of victim information.
• UK GDPR and EU GDPR, which apply where event records contain personal data about victims, detainees or named participants.
• ICD 203 analytic standards, requiring explicit confidence, source characterisation and separation of fact from inference.
• FAIR data principles, applied to dataset versioning, citation and reproducibility of event-based analysis.
• Dataset licence terms, including non-commercial and attribution conditions attached to several major event datasets.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. ACLED — Armed Conflict Location and Event Data Project. Coded global dataset of political violence and protest events with published methodology.
2. Uppsala Conflict Data Program — Uppsala University. Long-running academic dataset of organised violence with strict inclusion criteria.
3. GDELT Project — GDELT. Automated global event and theme coding from news media.
4. ReliefWeb — UN Office for the Coordination of Humanitarian Affairs. Humanitarian situation reports and disaster records from operational agencies.
5. Earthquake Hazards Program — United States Geological Survey. Authoritative real-time and historical seismic event catalogue.
6. Fire Information for Resource Management System — NASA. Near real-time satellite active fire and thermal anomaly detections.
7. Copernicus Emergency Management Service — European Commission. Satellite rapid mapping products quantifying disaster and conflict damage extent.
8. Humanitarian Data Exchange — UN Office for the Coordination of Humanitarian Affairs. Open platform for humanitarian datasets, boundaries and population figures.
9. EM-DAT — Centre for Research on the Epidemiology of Disasters. International disaster database with impact and casualty fields.
10. Berkeley Protocol on Digital Open Source Investigations — UN Office of the High Commissioner for Human Rights and UC Berkeley Human Rights Center. Standard for preserving open source material attached to documented incidents.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: fuses coded events with linked media, movement and disclosure records into a single searchable, source-cited timeline. Explore the platform, or browse the rest of the library by following any tag above.