Keyword / Narrative: Data Point Intelligence Guide

A keyword is a hypothesis about language. Track the wrong string and you will measure nothing at all, very confidently.

Understanding the Keyword / Narrative as an intelligence artifact

A keyword or narrative data point is a defined search construct: a term, phrase, hashtag, entity name, slogan or boolean expression used to select content across media, social platforms and forums. In practice it is never one string but a query definition with inclusion terms, exclusions, language variants, transliterations and time bounds. It represents an operational hypothesis, namely that this language reliably identifies the phenomenon of interest. Everything downstream, including volume trends, sentiment and network graphs, inherits the accuracy or the bias of that definition.

Variants that change results materially include stemming and morphology in inflected languages, transliteration schemes for non-Latin scripts, deliberate obfuscation through character substitution, emoji used as coded terms, and in-group jargon that shifts monthly. Hashtags behave differently from free text because they signal an intent to be found. Boolean support, wildcard behaviour and default operators differ across effectively every platform API you will use.

Why it matters

Narrative tracking detects coordinated behaviour before it produces offline consequences, identifies emerging fraud lures and extremist framings, and measures whether an influence effort is gaining traction beyond its origin community. Keyword sets also govern collection: a query definition determines what your entire monitoring programme is capable of seeing. Comparing volume against an established baseline exposes the anomalies, including coordinated seeding and brigading, that justify deeper investigation of specific accounts and networks.

What analysts actually look for

These are the concrete, observable signals that carry weight in this area of work:

• Baseline volume versus sudden spikes, distinguishing organic news response from coordinated seeding within a narrow window.
• Account creation dates clustering among amplifiers, indicating purpose-built rather than organic participation.
• Near-identical phrasing across many accounts, showing copy-paste amplification and shared messaging guidance.
• Cross-platform migration order, revealing which community originated a term and which merely repeated it later.
• Translation artefacts exposing whether content is locally produced or machine-translated from another language.
• Term mutation over time as communities evade moderation, which requires continuous query maintenance to keep recall.
• Co-occurring entities, domains and hashtags that map a narrative to specific actors, sites and monetisation routes.
• Engagement asymmetry, where high posting volume produces little authentic reply, indicating inflated apparent reach.

Where the data comes from

Authoritative and openly available collection points. Always confirm licensing and terms before operational or commercial use:

• GDELT — Free global news monitoring with theme, tone and entity extraction across many languages and decades.
• Media Cloud — Open media corpus for measuring term prevalence across curated national and topical news collections.
• Google Trends — Relative search interest over time and geography, useful as a demand-side baseline signal.
• Wikipedia pageview API — Free attention metric that often accompanies or slightly precedes a narrative surge.
• Common Crawl — Large open web corpus for measuring term prevalence outside social platform APIs.
• Reddit and forum public APIs — Community-level discussion data for tracking jargon emergence and cross-community migration.
• Internet Archive and archive.today — Preserves posts and articles before deletion so trend claims remain independently verifiable.
• EUvsDisinfo and DFRLab casework — Documented influence operations and disinformation cases providing validated narrative baselines, actor names and reference terminology.

A working method

A repeatable sequence beats ad-hoc searching. This is a practical starting workflow:

1. Define the construct — Write the query explicitly with inclusion terms, exclusions, language variants and transliterations, then version it like source code.
2. Pilot and measure precision — Manually sample several hundred matches, calculate precision and estimated recall, and refine before running the query at scale.
3. Establish a baseline — Collect several weeks of normal volume so that later spikes can be judged against expected variation rather than intuition.
4. Monitor and archive — Run continuously and archive matched content, because deletion is most common precisely on the material that matters most.
5. Analyse behaviour, not volume — Examine account age, posting cadence, phrasing similarity and network structure among amplifiers rather than counting posts.
6. Track mutation — Review newly co-occurring terms weekly and update the query as communities adopt replacement vocabulary to evade moderation.
7. Report with method — Publish the query definition, platform coverage and time window alongside any figure you cite in a product.

How this connects across the intelligence taxonomy

Intelligence work does not respect neat boundaries. The mission domain you are working, the disciplines you practise, and the data points you pivot on are one connected system. These are the direct relationships for this entry — every link is also a tag, so you can follow any thread across the whole library.

Collected by these disciplines

• News Intelligence — Media Reporting as an Intelligence Source
• Risk Intelligence — Structured Assessment of Threat and Consequence
• Disinformation Intelligence — Detecting and Analyzing Information Manipulation
• Cyber Intelligence — Adversary Activity in Networks and Systems
• Threat Actor Intelligence — Tracking Adversary Groups Over Time
• Open Source Intelligence — Publicly Available Information, Systematically Collected
• Social Media Intelligence — Intelligence from Social Platforms and Networks
• Geospatial Intelligence — Intelligence Derived from Place
• Academic Intelligence — Research Output, Collaboration, and Expertise
• Economic Intelligence — Economic Conditions, Trade, and Market Signals

Investigated in these domains

• Threat Analysis
• Emerging Technology & AI Security
• Extremism & Radicalization
• Climate Security
• Biosecurity & Pandemic
• Election Security & PSYOP
• Disinformation / IO
• Risk Analysis

Pivots to these data points

• Event / Incident — A discrete real-world occurrence — protest, strike, breach, seizure — with time, place, and actors.

Inside the platform: where Keyword / Narrative lives

The Quantus platform is 204 pages behind a 147-item sidebar organised into six working groups: Command (24 items), Dashboards (15), Threat Theaters (14), Intelligence Domains (15), Investigate (34), and Administration (45). This entry is not a page in isolation — it is a thread running through several of them.

The modules that matter most here:

• datapoint.php?dp=dp_keyword — Data point hub
• threats.php — Threat Analysis dashboard
• domain.php?d=emergingtech — Emerging Technology & AI Security dashboard
• domain.php?d=extremism — Extremism & Radicalization dashboard
• domain.php?d=climate — Climate Security dashboard
• search.php — Advanced search, filter and pivot
• correlate.php — Correlation graph
• cases.php — Case management

Each dashboard is local-first: it renders from the platform’s own database rather than depending on a live third-party call, so it still works when an upstream API is unreachable or rate-limited. Heavy aggregates are cached with a hard query time cap and degrade to the last good value instead of hanging the page.

Automation, playbooks and AI skills

Analysis that only happens when someone remembers to run it is not a capability. The platform ships a 30-step automation pipeline (cron.php) that collects, ingests, resolves, enriches, correlates and scores on a schedule — 25 seeders, 11 resolvers and 7 enrichment runners, all idempotent and cursor-based so a run can be interrupted and resumed without duplicating or losing work.

AI skills that apply

The 16 one-click operations in ai-skills.php are deterministic jobs, not free-text generation. The ones that matter here:

• Enrichment Runner
• Enrichment → Local
• Correlate Infrastructure
• Summarise (Copilot)
• Generate Report

Alerting closes the loop: rules in alerts.php fire on new indicators matching a saved query, so a first sighting in this area raises a notification rather than waiting to be noticed at the next review.

Feeds, data sources and the API

The collection layer runs a feed registry of free, machine-readable sources — bulk blocklists and trackers (Maltrail, IPsum, FireHOL, the full abuse.ch corpora, phishing databases, Emerging Threats, Spamhaus, DigitalSide, ThreatView), authoritative government feeds (CISA KEV, OFAC, UN and EU sanctions lists), and reference datasets (RIR allocations, ip-to-ASN and geolocation tables, MITRE ATT&CK, EPSS). collect.php pulls them server-side on a schedule; feeds.php and source-catalog.php show what is registered, what it covers and when it last ran.

Anything the platform holds is reachable programmatically. The REST API in api.php exposes 11 endpoints — status, stats, search, lookup, recent, export, bulk_check, top_threats, by_category, categories, check — and export.php streams 18 formats in bounded chunks, so a million-row export neither exhausts memory nor times out:

STIX 2.1, MISP, OpenIOC 1.1, CEF (ArcSight), LEEF 2.0 (QRadar), Zeek/Bro intel, Snort/Suricata rules, Palo Alto EDL, BIND RPZ, hosts blackhole, iptables, CSV, JSON, NDJSON/JSONL, XML.

That covers the CTI standards (STIX 2.1, MISP, OpenIOC), SIEM ingestion (CEF, LEEF, Zeek), detection engines (Snort/Suricata), and direct enforcement (Palo Alto EDL, BIND RPZ, hosts, iptables) — so intelligence developed here can be actioned in the tools you already run, without a manual reformatting step. A TAXII 2.1 server and a MISP/RSS feed are also served for pull-based sharing.

Use cases

Three ways this entry earns its keep in day-to-day work:

1. Triage under time pressure. An artifact or report lands and you need a defensible read in minutes, not days. Define the construct is the first move; the platform pre-computes the enrichment so the analyst spends the time on judgement rather than lookups.
2. Building the picture. A single indicator is rarely the story. Establish a baseline turns one artifact into a network — shared infrastructure, repeated selectors, the same operator behind different names — via the correlation graph and the cross-entity link engine.
3. Producing something actionable. Analysis that ends in a document nobody can use is wasted. Report with method feeds the case file, the detection rule, the block list or the referral — with sourcing attached so the recipient can verify it.

Case management (cases.php), watchlists, saved searches and scheduled reports mean the work persists between sessions and survives an analyst leaving the team.

How each sector uses Keyword / Narrative

The same entry is worked very differently depending on who you are, what authority you hold, and what you are ultimately producing. A military analyst is supporting a commander’s decision; a journalist is meeting a publication standard; an NGO caseworker is protecting a person. The underlying artifacts are shared — the constraints, outputs and thresholds are not.

🎖 Military and defence

Information environment assessment depends on defined query constructs. A versioned keyword set is what allows an analyst to say whether hostile messaging about a deployment is growing, where it originated and whether it is reaching the local population or only the originating community. Products include information environment updates, force protection advisories where messaging targets deployed personnel, and indicators of coordinated hostile activity feeding J2 and information operations staff. Constraints are firm: monitoring must target the phenomenon rather than named individuals, must not extend to protected persons or domestic populations where prohibited, and must respect platform terms. Query definitions belong in the collection plan and must be reviewed like any other collection requirement.

🕵 National intelligence

Narrative monitoring is a collection discipline whose ceiling is set by the query definition. Requirements should specify the phenomenon, the languages, the platforms and the period, and the resulting query should be versioned and auditable so that trend claims remain defensible. Fusion matters more than volume: a spike is meaningful only against a baseline and only when corroborated with account behaviour, infrastructure and offline events. Handling is straightforward for public content but becomes sensitive when queries are directed at individuals, which converts open source monitoring into something requiring separate authority. Report method alongside findings, since consumers routinely over-read raw volume figures.

👮 Law enforcement

Law enforcement uses keyword monitoring for threat-to-life detection, organised crime advertising, missing person appeals and public order planning. Evidential use requires preservation of specific matched content with hashes, timestamps and a documented collection method, not a screenshot of a dashboard. Monitoring that targets identified individuals or protected expression generally requires authorisation under directed surveillance regimes even where the content is public. Aggregated trend data supports resourcing and public safety decisions rather than charging decisions. Where a query surfaces indecent imagery or terrorist material, handling and escalation procedures must exist before monitoring begins rather than being improvised on discovery.

🔍 Private investigation and corporate security

Corporate security uses narrative monitoring for brand and executive threat assessment, disinformation affecting markets, counterfeit advertising and early warning of activist or extortion campaigns. The output that matters is behavioural: coordinated seeding by newly created accounts is a different problem from genuine customer anger, and conflating them produces bad decisions. A private actor must not build profiles of named individuals from monitoring, must not use tooling to track employees' lawful political or union activity, and must respect platform terms on scraping. Retention of personal data captured incidentally requires a stated lawful basis and a deletion schedule.

📰 Journalism and OSINT media

For journalists a keyword set is a reporting method that must be published alongside the finding. State the query, the platforms covered, the time window and the sampling limitations, because a volume claim without a method is not verifiable. Corroborate quantitative claims with qualitative reading of matched content, since homonyms, sarcasm and quote-tweeting invert meaning. Archive before publishing, as the most significant posts are usually deleted. Protect sources who surface material from closed communities. When naming accounts, consider that amplification of a fringe narrative by reporting it is a known risk, and apply a tipping-point judgement before covering it at all.

🌍 NGO, humanitarian and human rights

Human rights and peacebuilding organisations monitor language for early warning of incitement, hate speech targeting minorities and mobilisation toward violence. Practice must be victim-centred: the objective is protection and referral, not building dossiers on individuals. Collect at the level of the phenomenon, minimise personal data, and consider whether publishing terminology used by a targeted community could expose it to further attack. Where monitoring covers a community, seek engagement with that community rather than surveilling it. Analysts reading incitement and graphic material need rotation and support, and escalation routes to platforms and authorities must be agreed before monitoring starts.

🎓 University and research

Researchers must treat query definition as a measurement instrument requiring validation. Report precision and recall from a manually coded sample, publish the full query including exclusions and language variants, and version it, since query drift silently invalidates longitudinal comparison. Ethics approval is normally required because matched content contains personal data and may include vulnerable individuals. Platform terms restrict collection and redistribution, so release derived measures, coded samples and analysis code rather than raw corpora. State sampling explicitly: most platform APIs return samples rather than complete data, and absolute volume comparisons across platforms or over time are usually unsound.

Playbook: working Keyword / Narrative end to end

A repeatable sequence, from the moment the requirement lands to the moment a product is delivered and the case is closed out. Each phase states what you are trying to establish, not merely what to click — the point is a defensible chain of reasoning, not a checklist.

Phase 1 — Define the phenomenon before the query

Write in plain language what you are trying to detect and, equally important, what would count as a false positive. A query for a slogan will capture supporters, opponents quoting it, journalists reporting it and unrelated homonyms, and if you have not decided in advance which of those belong in scope, your precision figure is meaningless. Identify the languages, scripts and communities involved, and the decision the monitoring will support. The output is a short construct definition that the query is then written to operationalise.

Phase 2 — Build the query as versioned code

Express the query explicitly with inclusion terms, exclusion terms, language variants, transliteration schemes, hashtag forms, common misspellings and character substitutions. Store it in version control with a change log, because every modification changes what the trend line measures. Record platform-specific syntax differences, since boolean support, wildcards and default operators vary across effectively every API you will use. The output is a query artefact with a version identifier that can be cited in any product built from its results.

Phase 3 — Pilot and measure precision

Run the query over a bounded historical window and manually code a random sample of several hundred matches as relevant or not. Calculate precision directly. Estimate recall by seeking known relevant content the query missed, using a separate discovery method such as reading the community. Refine and re-measure. Stop when precision is adequate for the decision the data supports, which is a lower bar for early warning than for a published statistic. Record the measured figures alongside the query version.

Phase 4 — Establish a baseline

Collect several weeks of normal volume before drawing any conclusion about a spike, and characterise the normal pattern: weekday and weekend variation, time-of-day distribution, the usual mix of communities and languages. Without this, every news cycle looks like coordination. Where possible, build baselines for comparison terms so you can distinguish a general rise in attention from something specific to your phenomenon. The output is a documented baseline with variance, against which anomalies can be assessed statistically rather than impressionistically.

Phase 5 — Collect within terms and archive

Run collection through official APIs and licensed feeds where they exist, respecting rate limits and terms. Archive matched content, including author handle, timestamp, platform identifier and full text, with a hash and a collection time, because deletion is most common precisely on the material that matters. Retain personal data under a stated lawful basis with a retention limit rather than accumulating indefinitely. The output is a preserved corpus that supports later verification even after the original posts are removed.

Phase 6 — Analyse behaviour, not volume

Examine account creation date distribution among amplifiers, posting cadence, phrasing similarity, follower overlap, cross-platform posting order and engagement asymmetry. Coordinated seeding shows as tight temporal clustering, near-identical phrasing across accounts with no prior relationship, and high posting volume with negligible authentic reply. Genuine organic response shows dispersed timing, varied phrasing and real conversation. This distinction is the analytical product; raw volume is only the trigger that prompted the examination.

Phase 7 — Trace origin and migration

Establish which community used the term first and how it moved, ordering appearances across fringe forums, messaging channels, mainstream platforms and news coverage. Migration order tells you whether a narrative was seeded and laundered or emerged organically and was picked up. Translation artefacts indicate whether content is locally produced or machine-translated from another language. Record the earliest observed instance in each venue with an archived link. Stop when the earliest instances predate your archive coverage, and state that limit.

Phase 8 — Map the supporting infrastructure

Extract co-occurring domains, shortened links, monetisation routes, channel handles and recurring accounts to identify the sites, funders and operators behind a narrative. Domains connect to registration records, hosting and advertising identifiers; channels connect to messaging ecosystems. This converts a language phenomenon into an actor network with artefacts you can act on through platform reporting or further investigation. Record each link with its evidence rather than asserting a network from co-occurrence alone.

Phase 9 — Track mutation

Review newly co-occurring terms on a fixed cycle, because communities change vocabulary continuously, both organically and to evade moderation. Watch for character substitution, emoji used as coded terms, deliberate misspellings and shifts to new hashtags. Update the query and record the change with its date, since an unversioned update destroys the comparability of the whole series. The output is a maintained query whose recall does not silently decay, which is the most common failure in long-running monitoring programmes.

Phase 10 — Assess reach and impact honestly

Distinguish posting volume, impressions, authentic engagement and offline consequence. A narrative can generate enormous volume within a closed community and reach nobody outside it. Look for crossing points: coverage by mainstream outlets, adoption by public figures, appearance in search demand data, and correlation with real-world events. Where you cannot measure reach, say so rather than substituting volume for it. Overstating impact is the systematic bias of this discipline and the one consumers most readily believe.

Phase 11 — Report with method attached

Publish the query version, the platforms and languages covered, the time window, the sampling limitations and the measured precision alongside every figure. Separate observation from inference. State explicitly what the data cannot show, particularly about who is behind the activity, since coordination is observable while sponsorship generally is not. Where accounts are named, apply proportionality and consider amplification risk. Archive the supporting content so the finding remains verifiable after deletion.

Phase 12 — Review scope and retention

Periodically test whether the monitoring is still targeting a phenomenon rather than drifting into surveillance of individuals or protected expression. Review what personal data is retained, why, and for how long, and delete what no longer serves the purpose. Where monitoring touches political speech, journalism, activism or a specific community, apply a heightened proportionality review with a record of the decision. Check analyst wellbeing where the corpus includes incitement or graphic material, and rotate staff accordingly.

The platform ships this as a step-checked workflow in playbooks.php, so progress is recorded against a case rather than held in someone’s head.

Source register: what to collect from, and how

Sources are listed with their access model so you can plan around cost and licensing before you build a dependency on them. Open means no account required; registration means a free account or API key; licensed means paid or institutional access. Always confirm current terms — licensing changes, and a source that was free for research may not be free for commercial or evidential use.

Source	Access	What it gives you	How it is used here
GDELT Project	Open	Global news monitoring with automated theme, tone, entity and event coding across many languages since 1979.	Measures term and theme prevalence across global news with historical depth for baseline construction.
Media Cloud	Registration	Open platform for studying online news, with curated national and topical collections and term frequency tools.	Measures narrative prevalence across defined media collections rather than undifferentiated web content.
Google Trends	Open	Relative search interest over time and geography, with related query and rising term data.	Demand-side baseline showing whether a narrative produced genuine public curiosity beyond posting volume.
Wikimedia pageview and API services	Open	Public statistics on article views and edit activity across all language editions.	Independent attention metric that frequently accompanies or slightly precedes a narrative surge.
Common Crawl	Open	Large open archive of crawled web pages with regular snapshots and indexes.	Measures term prevalence on the open web outside platform APIs and their sampling limits.
Internet Archive Wayback Machine (archived)	Open	Web archive preserving pages, articles and profiles over time.	Preserves matched content and establishes earliest observed appearance of a term or claim.
archive.today	Open	On-demand snapshot service capturing rendered pages including social posts.	Preserves individual posts before deletion so trend and origin claims remain verifiable.
EUvsDisinfo	Open	European External Action Service database of documented pro-Kremlin disinformation cases with narrative summaries.	Validated narrative baselines and reference terminology for query construction and comparison.
Digital Forensic Research Lab	Open	Published investigations into coordinated inauthentic behaviour and information operations across platforms.	Methodological reference and case library for distinguishing coordination from organic amplification.
Reddit public API and data	Registration	Community-level discussion data across topical subreddits with post and comment structure.	Tracks jargon emergence and migration between communities before terms reach mainstream platforms.
ACLED	Registration	Coded dataset of political violence, protest and demonstration events with dates, actors and locations.	Tests whether an online narrative surge corresponds to offline mobilisation or remains purely online.
First Draft and verification handbooks	Open	Published methodology on verifying online claims, sourcing and responsible reporting of manipulation.	Reference for tipping-point judgements on whether reporting a narrative amplifies it.
Oxford Internet Institute research	Open	Academic research on computational propaganda, platform governance and online political communication.	Peer-reviewed methodology for measuring coordination and reach in social media data.
Stanford and Princeton platform research collections	Open	Published datasets and reports on coordinated influence operations disclosed by platforms.	Ground truth cases of confirmed operations for validating detection heuristics.
Unicode CLDR and transliteration data	Open	Locale data including transliteration rules, script conventions and language identifiers.	Systematic construction of transliteration and script variants rather than ad hoc guessing.

Prefer sources that publish a methodology and a revision history. A dataset that changes silently is a liability in any product that has to survive challenge.

Tooling

Tools commonly used against Keyword / Narrative. None of these replace judgement, and each carries its own failure modes — know what a tool infers versus what it observes.

• Version-controlled query definitions — Treats the query as code with a change log and identifiers. Limitation: requires discipline that most monitoring teams never adopt, and retrofitting it is impossible.
• GDELT query interfaces — Free large-scale news term and theme measurement with long history. Limitation: automated coding produces systematic errors and its entity extraction is uneven across languages.
• Media Cloud — Term prevalence across curated media collections with transparent sourcing. Limitation: covers news rather than social platforms, so it misses origin communities.
• Platform APIs and licensed feeds — The only terms-compliant route to social data at scale. Limitation: most return samples rather than complete data, making absolute volume comparisons unsound.
• Archiving pipelines — Preserve matched content with hashes before deletion. Limitation: archiving at query scale is storage-heavy and rapidly collides with data protection retention limits.
• Network and coordination analysis tooling — Detects temporal clustering, phrase similarity and account co-occurrence. Limitation: coordination detection has high false-positive rates on genuine communities with shared talking points.
• Machine translation and language identification — Extends coverage across languages quickly and flags translation artefacts. Limitation: fails badly on slang, coded terms and low-resource languages, which is where the signal usually is.
• Sampling and manual coding workflows — Measures precision directly and keeps analysts reading the actual content. Limitation: labour-intensive, so it is the first activity cut when volume rises.
• Baseline and anomaly detection — Flags deviation from expected volume rather than absolute counts. Limitation: seasonal and news-driven variation generates constant alerts without careful parameterisation.

AI skills and automation in detail

These are deterministic jobs with defined inputs and outputs, not open-ended prompting. Each is idempotent and cursor-based: interrupt one and it resumes where it stopped rather than duplicating work or losing progress.

• Enrichment Runner — Walks the indicator set through a chosen provider in time-boxed, cursor-based batches that resume rather than restart.
• Enrichment → Local — Materialises enrichment into the local store so dashboards render from your own database instead of a live third-party call.
• Correlate Infrastructure — Builds the cross-entity link graph: shared hosting, reused certificates, overlapping registrants, repeated selectors.
• Summarise (Copilot) — Produces a narrative summary beside the underlying records. It explains; it never creates indicators or assigns attribution.
• Generate Report — Assembles a sourced product from the current case or query, with provenance attached to each element.

A note on the boundary: the only skill that involves a language model is Summarise (Copilot), and it writes prose about records that already exist. Nothing else on this list involves generation of any kind. No indicator, relationship or attribution in the platform originates from a model. See the full skill list.

Tradecraft notes

The distinctions that separate a competent analyst from a fast one:

• The query is the instrument, and an unversioned query makes every trend line uninterpretable. If you cannot say which definition produced a figure from six months ago, that figure is not evidence of anything.
• Measure precision on a manually coded sample before running at scale. Teams that skip this routinely discover months later that a third of their corpus was a homonym or a brand collision.
• Volume is a trigger, not a finding. The analysis is in account creation clustering, phrase similarity and engagement asymmetry, and reporting volume alone systematically overstates influence.
• Migration order between communities is the single most informative structural signal available. It distinguishes a narrative seeded in a fringe venue and laundered upward from one that emerged organically.
• Term mutation is continuous and deliberate. Monitoring that is not reviewed on a fixed cycle loses recall silently, and the resulting flat line reads as the narrative dying rather than the query going blind.
• Monitor the phenomenon, not people. The moment a query is pointed at a named individual it stops being open source monitoring and becomes something requiring separate authority and justification.
• Machine translation is adequate for triage and dangerous for conclusions. Coded terms, in-group jargon and sarcasm are exactly what translation destroys, and they carry the meaning you are looking for.
• Decide in advance what would falsify the coordination hypothesis. Genuine communities share talking points and post at similar times, and coordination detection without a null model finds coordination everywhere.

Measuring whether it is working

Capability claims should be falsifiable. These are the measures that show whether work on Keyword / Narrative is producing anything, and they are worth baselining before you change process or tooling.

• Measured precision of each production query against a manually coded sample, re-measured on a fixed schedule rather than once at launch.
• Proportion of published figures accompanied by query version, platform coverage, time window and sampling caveat.
• Detection lead time between a coordinated surge appearing in monitoring and it being reported publicly elsewhere.
• Recall decay measured by periodic discovery of relevant content the current query missed, driving scheduled query updates.
• Share of alerts that resulted in a documented analytical judgement rather than being closed as news-cycle noise.
• Percentage of matched content archived with hash and timestamp before deletion, measured against later link rot.
• Compliance review outcome on scope: proportion of queries confirmed as targeting phenomena rather than named individuals.

Beware of measuring volume alone. Indicator counts and report counts rise easily and say little; time-to-attribution, proportion of findings that survive review, and how often a product changed a decision say a great deal.

Common pitfalls

• Homonyms and brand collisions inflate counts enormously; a term that means two things measures neither of them accurately.
• Platform APIs sample rather than return complete data, so absolute volumes are rarely comparable across sources or time.
• Query drift renders trend lines meaningless unless every change to the definition is versioned and dated.
• High volume is not influence; measuring amplification without measuring authentic reach systematically overstates impact.
• Monitoring a single language or script reliably misses the origin community of most transnational narratives.
• Searching extremist or exploitative terms can surface illegal material, so define handling and escalation procedures before starting.

Legal and ethical considerations

Narrative monitoring slides easily into surveillance of individuals and protected expression. Keep collection focused on public content and on the phenomenon rather than on named private persons, and document a lawful basis and retention limit for any personal data stored. Respect platform terms covering scraping and API use. Where monitoring touches political speech, journalism or activism, apply heightened proportionality review, and never use narrative tooling to profile individuals by protected characteristics.

Data integrity: no fabrication, no drift, no hallucination

Intelligence that cannot be traced back to a source is not intelligence, it is assertion. Everything in this entry — and everything in the platform behind it — is built on a small number of non-negotiable rules.

Provenance on every record

Every indicator carries the source that supplied it, a first-seen and last-seen timestamp, and a sighting count. Where several feeds report the same artifact, each contribution is recorded separately rather than collapsed, so you can see whether a finding rests on one source or twelve. Source attribution travels with the data into every export, so a recipient can audit a claim without asking you for the working.

Nothing is invented to fill a gap

If the platform has no data for Keyword / Narrative, it says so. Empty is displayed as empty — never padded with plausible-looking placeholder values, sample records or illustrative examples that a reader might mistake for observations. A dashboard with no rows is a true statement about collection coverage, and it is treated as a gap to close, not a blemish to hide.

Scoring is deterministic and reproducible

Threat scores, reputation grades and risk tiers are computed from stated inputs with fixed weights, not estimated. The same inputs always produce the same output, and the formula is visible rather than a black box. Aggregates are cached with an explicit time-to-live so a figure on screen is never silently stale — and when a heavy query exceeds its time budget the platform serves the last known-good value and labels it, rather than inventing a fresh number or hanging.

Where AI is used, and where it is not

Language models summarise and explain. They do not create indicators, assign attribution or manufacture relationships. No IP address, wallet, hash or identity in the platform originates from a model — every one is ingested from a named feed, resolved from a reference dataset, or entered by an analyst with a source recorded. Copilot output is presented as narrative alongside the underlying records, never in place of them, so a reader can always check the summary against the evidence.

Guarding against drift

Enrichment is additive and timestamped rather than overwriting. Reference data — sanctions lists, allocations, taxonomies — is re-synchronised from the authority on a schedule instead of being edited in place, so local copies cannot quietly diverge from the source of truth. Attribution is recorded with a confidence level and the reporting it rests on, and inferred relationships are labelled as inferred. When a source retracts or corrects, the correction propagates rather than leaving a stale assertion behind.

What this means for you

You can put a finding from this platform in front of a regulator, a court, a board or a partner agency and show where each element came from. That is the standard the tooling is built to — because in this work, being confidently wrong is more damaging than being usefully uncertain.

By the numbers

The taxonomy this entry belongs to is not a marketing list — it is the actual structure of the platform: 52 mission domains, 52 intelligence disciplines and 65 data points, each with a live dashboard behind it. Supporting that: 18 indicator types, 14 playbooks, 16 AI skills, 18 export formats and a 30-step automated pipeline.

This particular entry connects directly to 10 intelligence disciplines, 8 mission domains, 1 closely related entries — every one of them a tag you can follow, and a dashboard you can open.

Questions analysts actually ask

How do I know whether a spike is coordinated or organic?

Compare against your baseline first, since ordinary news cycles produce large spikes. Then examine structure rather than size: account creation dates clustering in a narrow window, near-identical phrasing across accounts with no prior relationship, tight temporal clustering within minutes, engagement asymmetry where posting volume produces little authentic reply, and a migration path that starts in a small venue and jumps to many accounts simultaneously. Organic surges show dispersed timing, varied phrasing, real conversation and gradual spread. Define your null model in advance, because genuine communities also share talking points and post at similar hours.

Can I compare volume figures across platforms?

Generally no. Platform APIs sample rather than return complete data, sampling rates change without notice, indexing differs, and what counts as a post differs across services. Absolute counts are therefore not comparable across platforms and often not comparable over time on the same platform. What is comparable is a normalised measure against your own baseline for that platform and query version, or a ratio between two terms collected identically. State the limitation whenever you publish a figure, because consumers will otherwise treat the number as an audience measurement.

How often should a query be updated?

Review on a fixed cycle, typically weekly for fast-moving phenomena and monthly for stable ones, and out of cycle when moderation changes or an event shifts vocabulary. Look at newly co-occurring terms in matched content to spot emerging variants, and sample the community directly rather than relying only on the query. Every change must be versioned and dated, because an unrecorded update destroys comparability of the series. Where a change materially alters recall, treat it as a new series rather than continuing the old line through the discontinuity.

What is the risk of reporting on a fringe narrative?

Amplification. Coverage of a narrative that had negligible reach can introduce it to a far larger audience, and this is a documented effect rather than a theoretical concern. Apply a tipping-point judgement: has it crossed into mainstream circulation, been adopted by consequential actors, or produced offline harm. If not, consider whether the story is the narrative or the operation behind it, and whether you can report the mechanism without reproducing the message. Where you do report, avoid repeating the claim in headlines and prioritise the debunk framing over the claim itself.

Is keyword monitoring lawful?

Monitoring public content about a phenomenon is generally defensible with a documented lawful basis, retention limit and proportionality assessment. It becomes legally sensitive when directed at identified individuals, when it profiles people by protected characteristics, or when it targets journalism, activism or political speech, all of which may require specific authorisation and heightened justification. Automated collection commonly breaches platform terms. The workable posture is phenomenon-level collection, minimisation of personal data, a stated retention period, access control and a periodic scope review recorded in writing.

How do I handle non-Latin scripts and transliteration?

Build variants systematically rather than by guesswork. Use locale data for standard transliteration schemes, include the native script forms, common romanisations, and the informal transliterations that communities actually use, which often differ from any standard. Account for morphology in inflected languages, where stemming behaviour differs across platform search engines. Have a native speaker review the query, because coded terms and in-group usage will not be visible to a translation tool. Measure precision separately per language, since a query that performs well in one may be badly broken in another.

What should we do when a query surfaces illegal material?

Have the procedure written before you start monitoring, not after discovery. Define what triggers escalation, who is authorised to view it, how it is reported and to whom, and what is deliberately not retained. For child sexual abuse material, do not download or retain: report immediately to the designated national hotline and follow their instruction. For terrorist material, follow the national reporting route. Record the referral, restrict access, and provide support to the analyst involved. Retention of illegal material without lawful authority is an offence regardless of investigative purpose.

Standards, frameworks and further reading

Work that references a recognised framework is easier to defend, easier to hand over, and easier for a partner to consume:

• UK GDPR and EU GDPR, governing lawful basis, minimisation, retention and profiling restrictions for monitoring that captures personal data.
• Directed surveillance authorisation regimes, which apply where public-source monitoring becomes targeted at identified individuals.
• Association of Internet Researchers ethics guidance, the standard reference for ethical collection and publication of online data.
• European Code of Conduct for Research Integrity, governing methodological transparency and data handling in academic monitoring work.
• Digital Services Act transparency and researcher data access provisions, which define lawful routes to platform data in the European Union.
• Platform terms of service and API policies, which govern automated collection, storage and redistribution of platform content.
• Rabat Plan of Action thresholds, used to assess when monitored speech crosses into incitement requiring escalation.
• FAIR data principles, applied to publishing query definitions, coding schemes and derived measures for reproducibility.

References

Primary sources and authoritative references for this entry. Publishers revise and retire material, so treat the retrieval date as part of the citation and re-check before relying on any of it in a formal product.

1. GDELT Project — GDELT. Open global news monitoring dataset with theme, tone and entity coding.
2. Media Cloud — Media Cloud. Open research platform for measuring narrative prevalence across news collections.
3. EUvsDisinfo database — European External Action Service. Documented disinformation cases with narrative summaries and source records.
4. Digital Forensic Research Lab investigations — Atlantic Council. Published casework on coordinated inauthentic behaviour and influence operations.
5. Common Crawl — Common Crawl Foundation. Open web crawl archive used for measuring term prevalence outside platform APIs.
6. ACLED — Armed Conflict Location and Event Data Project. Coded protest and political violence events used to test online to offline correspondence.
7. Oxford Internet Institute research programme — University of Oxford. Academic research on computational propaganda and online political communication.
8. Stanford Cyber Policy Center research — Stanford University. Analysis of platform-disclosed influence operations and coordinated behaviour.
9. Association of Internet Researchers ethics guidance — Association of Internet Researchers. Standard ethical framework for internet-based research and data collection.
10. Unicode CLDR — Unicode Consortium. Locale and transliteration data supporting systematic multilingual query construction.

Link integrity: every reference above was verified with a live request when this page was generated. Where a publisher had moved or withdrawn a document, the link was repointed at a preserved copy in the Internet Archive and marked as archived. Anything with no reachable copy anywhere had its link removed rather than left to rot — the source is still credited, it simply cannot be linked.

Put it into practice

The Quantus Intel threat intelligence platform operationalises this entry: runs versioned narrative queries across news, forums and archives with baselines, spike detection and preserved evidence. Explore the platform, or browse the rest of the library by following any tag above.