Knowledge graph

10 min

This page explains the knowledge graph, Vantage's data model: the objects Vantage records, the relations it establishes between them, and why the relations carry the intelligence. It is written for analysts and technical users who want to understand what sits behind a Point AlertPoint Alert, a BriefBrief or an Ask EmberAsk Ember answer.

Objects

The nodes: Narratives, Assets, Publications, Incidents, Influence Operations, Actors.

Relations

The edges between them, each recorded as a first-class record with its own evidence trail.

Incident

The object where what is being said and what is being done meet in one record.

What the knowledge graph is

The knowledge graph is the record Vantage keeps of everything it detects in your Information Landscape, stored as objects and the relations between them. Objects are nodes: Narratives, Assets, Publications, Incidents, Influence Operations, Actors. Relations are edges, and the edges are first-class records in their own right. An Asset produces a Publication. A Publication advances a Narrative. A Sub-Narrative specifies its parent. A Known Asset may, or may not, be attributed to an Actor.

The graph is the data model itself, not a drawing made afterwards. Every surface in Vantage reads from it: a Point AlertPoint Alert, BriefBrief, Narrative PulseNarrative Pulse and an Ask EmberAsk Ember answer are different views of the same record. That is why a fact established in one place, such as a Known Asset designation, appears everywhere the Asset does.

The graph also settles a question the field keeps getting tangled in: whether narrative intelligence is about meaning or about activity. It is one picture. What is being said and what is being done are recorded in the same graph, and the object that carries both at once is the Incident.

The objects Vantage records

Every object below is a node in the graph. Designations (Reference Asset, Known Asset) are applied on top of a neutral Asset record rather than being separate kinds of object.

Information Warfare is deliberately excluded: it names a strategic condition, and the graph marks it without storing it.

Layer	Object	What it records
Terrain	Information Landscape	The set of Assets whose activity targets a specific individual or group. Scoped by who is targeted, never by where information originates.
Meaning	Narrative	A recurring pattern of meaning, structured as Agent \| Operator \| Target.
Meaning	Sub-Narrative	A specific instantiation of a Narrative that adds a Specifier.
Meaning	Narrative Trigger	The cluster of real-world discussion that activates or reactivates a Narrative at a moment in time. Optional.
Meaning	Patient Zero	The first Publication identified as the origin of a Narrative or Operation.
Producers	Asset	Any account, page, channel or website in the landscape. A neutral record carrying no judgment.
Producers	Reference Asset	An Asset you own or treat as a known reference point, held outside the classification pipeline as a measurement anchor.
Producers	Known Asset	A designation on an Asset whose behavioural evidence warrants elevated scrutiny, carrying an Evidence Score of Possible, Probable or Confirmed.
Content	Publication	Any single post, article, share or repost produced by an Asset. The atomic content unit.
Content	Platform, Website, Media Outlet	The three venue types a Publication can appear on, held distinct because they produce different signals and response options.
Detection	TTPs	The observable, repeatable behaviours an Asset exhibits, mapped to DISARM and, where cyber tradecraft overlaps, MITRE ATT&CK.
Activity	Incident	The smallest recorded unit of engineered activity. Holds the Assets, Publications, TTPs, Narrative and Sub-Narrative, venues and timing of one episode.
Activity	Influence Operation	A set of Incidents identified as one deliberate, organised, weaponised effort.
Outcome	Actor	A single class of principal: state, organisation, network or individual. Structure between Actors is recorded as relations.
Measure	Breakout Scale	Ben Nimmo's six-point measure of how far an Operation's content has spread. Recorded against the Operation.

How the objects connect

flowchart LR
  A[Asset] -->|produces| P[Publication]
  P -->|advances| N[Narrative]
  SN[Sub-Narrative] -->|specifies| N
  NT[Narrative Trigger] -.->|may activate| N
  A -->|exhibits| T[TTPs]
  A -.->|designated| KA[Known Asset]
  KA -.->|may be attributed to| AC[Actor]
  P -->|composes| I[Incident]
  T -->|recorded in| I
  I -->|advances| SN
  I -.->|compiles into| IO[Influence Operation]
  AC -.->|originates, directs, funds, executes| IO
  IO -.->|spread measured on| BS[Breakout Scale]
  classDef producer fill:#eef4ff,stroke:#3b6fd6,color:#1b2a4a
  classDef meaning fill:#f3ecff,stroke:#7c4dcc,color:#2a1b4a
  classDef activity fill:#fff1e6,stroke:#d9772b,color:#4a2a12
  class A,KA,AC,P,T producer
  class N,SN,NT meaning
  class I,IO,BS activity

Read it left to right and top down: an Asset produces a Publication that advances a Narrative, a Sub-Narrative specifies that Narrative, and a Narrative Trigger may activate it. Designations and attribution are layered on top of the Asset. The Incident is where the two halves meet, and Incidents compile upward into an Influence Operation. Blue nodes are who acts and what they produce, purple nodes are the meaning layer, and orange nodes are the recorded activity. Solid lines are relations Vantage records as part of detection. Dashed lines are conditional relations, added only when the evidence establishes them.

The relations in full

These are the edges. Naming them is the substance of the model, because they are what must be established and recorded for a set of observations to become intelligence. Vantage records each one as a first-class relation with its own evidence trail.

Relation	What is established
Production	An Asset produces a Publication. A Publication advances one or more Narratives or Sub-Narratives. A Sub-Narrative specifies its parent Narrative.
Activation	A Narrative Trigger activates one or more Narratives or Sub-Narratives at a moment in time. The earliest originating Publication is Patient Zero for that Narrative or Operation. A trigger is never required for an Incident, and an Incident can itself become a trigger.
Designation	An Asset carries an Evidence Score and, on crossing a threshold, is designated a Known Asset. A Known Asset may be attributed, through a relation, to an Actor. This edge is optional and frequently never established.
Behaviour	Assets exhibit TTPs, including Coordinated Inauthentic Behaviour, mapped to DISARM and, where cyber tradecraft overlaps, to MITRE ATT&CK.
Composition	Several Assets and their Publications compose an Incident. The Incident advances a Narrative and a Sub-Narrative, records the TTPs its Assets exhibited, is observed on Platforms, Websites or Media Outlets, and is stamped with when it was seen.
Compilation	A set of Incidents identified as one effort compiles into an Influence Operation. The Operation targets a population within the Information Landscape, and its spread is measured on the Breakout Scale.
Attribution	Actors connect to activity through relations: originate, direct, fund, execute. Structure between Actors is itself relational: direction, contracting, funding, coordination, fronting. Attribution confidence is stated as Possible, Probable or Confirmed.
Measurement	A Reference Asset anchors measurement within the Information Landscape rather than being classified.

Many of these edges are conditional. Attribution may never be reached. A trigger may be absent where a manufactured resurgence created its own pretext. The Breakout Scale may sit at Category 1 for an Operation that never spreads. The graph is built to hold a complete, useful record with many optional edges empty, and to add them as evidence arrives.

Why relations sit at the centre

Putting relations at the centre resolves three things that rigid, field-based schemas get wrong.

Attribution is an edge, not a field. A Known Asset stands on its own and can acquire an Actor later, or never. The intelligence is complete and actionable long before anyone is named behind it, which matters because attribution is reached in a minority of cases. The Known Asset designation itself is an evidentiary statement about behaviour. It is never an attribution label.

One node can hold many attachments. A Narrative can attach to an Incident and to an Influence Operation at once, because attachment is a relation. A single Publication can advance several Sub-Narratives. Nothing has to be copied or duplicated to express this.

Structure between Actors is recorded as relations, not sub-types. A firm hired by one state can be hired by another. An organisation that fronts for a state in one operation acts alone in the next. Recording who directs, contracts, funds or fronts for whom keeps the picture accurate as arrangements change, and the recorded relation is itself evidence that supports a referral or a sanctions case.

The same design is what lets the Incident carry meaning and activity together. The Narrative and Sub-Narrative on one side, the Assets, Publications, behaviours and timing on the other, recorded as one object. Vantage records Incidents rather than campaigns for the same reason: a campaign assumes a single organising hand and a fixed intent before the evidence supports either, while an Incident assumes only what was observed. Whether many Incidents belong to one effort is answered by compiling them, never by labelling each one at the moment it is detected.

How it works in Vantage

The graph is built continuously, without an analyst in the loop, as detection runs over your Information Landscape.

A Point Alert opens an Incident. When detection fires, the Point Alert creates the Incident record. As further alerts fire on the same Assets, behaviours and Narrative, they attach to that same Incident rather than spawning new ones, so the Incident grows as the episode develops.

Incidents compile into an Influence Operation. Incidents that share Assets, behaviours, targeting and Narrative compile upward into an Operation once the Organised, Deliberate and Weaponised diagnostics are met. Where intent cannot be shown, the activity stays recorded as Incidents and is held open, ready to compile the moment further evidence arrives. The Operation's spread is tracked on the Breakout Scale.

Assets accumulate evidence. Every Asset involved in an Incident carries its history forward. Behavioural evidence from internal detection and external reporting raises its Evidence Score, and crossing the threshold designates it a Known Asset. Weakening or retracted evidence lowers the score and can remove the designation. Every designation traces to specific evidence points and is explainable on request.

Attribution attaches as relations. Where attribution is reached, it is recorded as relations between Known Assets and an Actor, and between Actors, with confidence stated. Vantage expresses attribution in three layers of increasing strength, mapped to the EEAS FIMI Exposure Matrix:

Layer	What it establishes	How it is reached
Alignment	Alignment with a threat actor's known output	Detection and investigation
Linkage	Shared infrastructure or operational fingerprints	Detection and investigation
Operator attribution	Infrastructure resolved to a registrant, company or person	A separate investigative service

Every surface reads the same record. Ask EmberAsk Ember answers questions by traversing the graph, which is why it can return the Assets advancing a Narrative, the Incidents an Asset appears in, or when a Narrative last recurred, with the evidence attached. Narrative PulseNarrative Pulse reads the meaning layer; Point Alerts and Briefs read the Incident layer.

The record is interoperable. Incidents and their evidence are recorded in structured, exportable form. Vantage can export in STIX and TAXII today, so an Incident can travel into a security operations centre or a partner's workflow without being rebuilt by hand. See Exporting, sharing and integrationsExporting, sharing and integrations.

How far a single record follows a Narrative across borders depends on your plan: on a per-country scope, the same Narrative in two countries produces two separate Incident threads; on a cross-country scope, one thread follows it as it travels. See Vantage plansVantage plans.

Narratives, sub-narratives, narrative triggersNarratives, sub-narratives, narrative triggers

Assets, Known Assets and Reference AssetsAssets, Known Assets and Reference Assets

Information landscape and signal streamsInformation landscape and signal streams

Detection principlesDetection principles

Exporting, sharing and integrationsExporting, sharing and integrations