Link Analysis View
The Link Analysis View is a crucial view within the OWL result screen. The Data Visualization view transforms complex datasets into intuitive graphical formats, making it easier to uncover patterns, trends, and anomalies. By filtering noise and emphasizing key insights, visualization effectively narrates the story behind the data.
In this view, each attribute is represented as a distinct node. When multiple attributes share a connection, they are linked by lines, and a star icon appears on the corresponding node to signify the match.
Link Analysis View Overview
- A Link Analysis View is one of the views you can choose from the product's search page before initiating a search in OWL.
- Every Query search in Whooster follows a hierarchical structure to display all the whooster vendor data on the screen. So that it can be easily understood and analyzed by the investigators from the Data Visualization view.
The response structure in the Link analysis view is as follows:
Query Node ->Vendor Node ->atasource Node(s) ->Identity Node(s) ->Child Node(s) ->Wrapper Node(s)
- Query Node: Serves as the root node for every search conducted in the Whooster edition. It holds the primary search variable and connects directly to the associated Whooster vendor node.
- Vendor Node: A direct child of the Query Node; this node represents the Whooster data connector. It acts as the gateway to all available Whooster data sources.
- Datasource Nodes: These nodes represent the specific Whooster product data sources selected during the search, such as Advanced Phone & Person, Basic Phone, or Social Media Phone. Each Datasource shares a common search criterion, typically a phone number.
- Identity Nodes: Child nodes of the Datasource Nodes; Identity Nodes contain individual entity records—such as people or organizations—retrieved from the respective Whooster product. They are grouped based on the Datasource they originate from.
- Child Nodes: These nodes represent detailed attributes associated with an identity, such as SSNs, alternate phone numbers, relatives, and addresses. Each Child Node is linked to its corresponding Identity Node.
- Wrapper Nodes: Wrapper Nodes are the most granular level in the hierarchy. They encapsulate sub-details or metadata related to each Child Node, effectively serving as the grandchild nodes in the structure.
Exploring Link Analysis Features and Functionality:
Highlighted New Searches
Each newly initiated search appears visually highlighted within the Link Analysis View, making it easy to distinguish from previously conducted searches.
Node-Level Insights on Hover
Hovering over any node in the Link Analysis View reveals detailed information about that specific node.
o For example, hovering over a Query Node displays key details about the search input, such as the search variable and associated metadata.
Search Criteria, Search Type, Search Hierarchy, Searched Dataset, Searched By/On
- Hierarchical Tree Structure The Link Analysis View organizes all nodes in a clear hierarchical, tree-style layout, reflecting parent- child relationships between data layers.
- Distinct Identity Nodes by Source Identity nodes originating from different data sources are visually separated and never overlap, ensuring clarity in multi-source investigations.
- Expandable and Collapsible Nodes Each node includes expand/collapse controls, allowing users to reveal or hide associated child nodes as needed.
- Default Collapsed View By default, all child nodes under an identity node are collapsed to maintain a clean interface. Users can expand them individually using the provided toggle.
- Structured Expansion Layout When expanding identity or child nodes, they are displayed in a sequential tree layout—typically showing up to three identity nodes per row. Additional child nodes appear in subsequent rows, allowing the view to grow horizontally without overlapping, preserving readability.
- Custom Node Positioning Users can drag and reposition any node within the Link Analysis View. These custom placements are saved automatically, so the layout remains consistent each time the search is reopened.
- Each identity is defined with a different node icon based on its type of data.
- Each node in the link analysis view has a Spyglass icon on it. This option allows you to perform specific tasks from the Link Analysis view. Depending on the type of node, the actions available in the Spyglass menu change.
Each Query Node in the whooster edition contains two options.
o Rerun: This option executes the same query search again to get the latest response from the Whooster vendor.
o Monitoring: This option is to add a scheduler for the Query Node to perform the automatic rerun search on a specific date and time. (Not available in Whooster Edition Plan)
- Each product data source node will show the number of identities found under the product search.
- Show Details: When you click this option, the Data Manager panel appears on the right. It automatically navigates to the node you selected, displaying its details.
- You can export the Identity level information into PDF or Excel by using the Download PDF & Download Excel Report options available on the Spyglass option.
- Each Identity coming from the whooster product search may contain data that is eligible for a new search using the same whooster product or other whooster products based on criteria or search variables available. OWL provides the option to directly perform those searches from the identity or child nodes in the visualization view. These options are available inside the Spyglass menu under Additional Search, Person Search, and Pivot Search sections.
From the Link Analysis view result screen, you can initiate Person Detail and Enhanced Report searches.
Steps to perform a Detail/Enhanced Report search from the Link Analysis View:
- Run a Whooster person search in OWL.
- Navigate to the result screen and select the Link Analysis view.
- Expand the Data Query Node.
- Locate the relevant identity within the query node.
- On the identity node, click on the Spyglass icon, and you will find options to download Detail and Enhanced Reports. - Select either option to perform the corresponding search.
- OWL will launch the Detail/Enhanced Report search as a spyglass search and generate a new response.
- Once the page loads, a new query node will appear in the views along with the report details."
- You can perform multiple searches under a single case number. When multiple searches are linked to the same case, OWL automatically compares the data across identities. If two searches share matching information—such as SSN, phone number, name, or address—OWL generates a relationship record between those nodes.
These relationships are displayed in the visualization view, connected by a relationship line. The color of each line is determined by the OWL prevalence settings, making it easy to distinguish matches in link analysis:
Exact matches (100% score) → Green relationship line
Partial matches (scores between 0–100) → Different colors assigned to each range for quick visual distinction
This color-coding system helps you quickly identify the strength of relationships between nodes during analysis.
- Click on the Star icon on each relationship line will open a Relationship records popup where it will show all the information that is matched between the two nodes, and the matching score between each record matching between the two nodes.
- You can update or modify the relationship data prevalence settings directly from the Link Analysis view. In the top-right corner, click the pencil icon next to the Match or Score label to open the settings pop- up.
- By default, the match algorithm is set to Exact Match with a score threshold of 80. This means the Link Analysis view will only display relationships that are exact matches and have a score above 80. To adjust these settings, you can choose Phonetics or Smart Match and set a threshold score anywhere between 0 and 100. Once updated, click Apply to Case to reload the screen with the new settings applied.
- The Data Prevalence Scale allows you to show or hide relationship lines based on their score. For example, deselecting the green box will hide all 100% score relationship lines from the Link Analysis view.
- Reset Node position: On the Link Analysis Canvas, the reset option in the top-right corner restores node positions in a saved view to the default layout. Click this button to quickly reorganize data query nodes and search results, especially when the canvas becomes cluttered.
- View All Hidden Nodes: During investigations, it's common to hide nodes that aren't immediately relevant. When many nodes are hidden, manually revealing them from their parent nodes can be tedious. The View All Hidden Nodes option simplifies this by instantly unhiding all hidden nodes with a single click, making it easier to restore visibility and streamline your analysis.
- View All Expanded: At times, it's important to preserve the current layout of the view without expanding or collapsing any nodes. The View All Expands feature allows you to lock the currently expanded nodes and their child nodes in place, ensuring the view remains unchanged and focused exactly as intended.
- Save Node Positions: The Link Analysis View includes a key feature that ensures node positions remain exactly as you’ve arranged them on the canvas. Even after reloading or reopening the result screen, the layout won’t revert to previous states. While node positions are automatically saved when moved, this feature guarantees that all nodes retain their current placement for consistent reference and analysis.
Select Nodes Tool:
The Select Nodes Tool in the Link Analysis View allows you to hide or zoom in/out on specific nodes for better visibility and focus.
How to use it:
- Click on the Select Nodes Tool.
- Your mouse cursor will change to a selection icon.
- Use the cursor to select one or more nodes directly on the canvas.
- Once selected, a menu will appear just below the tool.
- From this menu, choose to either hide the selected nodes or zoom in/out on them.
Link nodes tools: This helps to create relationships by linking two already existing nodes from two different searches and creating a custom mapping between them. Once the relationship is created, there will be a line drawn between the two nodes to define the relationship's strength.
Steps: 1. Click on the Link node tool, then select one node from one search response. 2. Click on the other node of a different search. This will open the relationship record pop-up. 3. It will show if already records are present, or you can add new custom mapping.
- Fit To Screen: When multiple data query results are displayed on the screen, the Link Analysis View may struggle to fit all nodes within the visible area, especially on smaller screens. The Fit to Screen feature addresses this by automatically centering and scaling all queries and data nodes to fit within the available screen space. This ensures that the entire view remains accessible and easy to navigate, regardless of screen size.
- Zoom In/Out: These options allow you to zoom in and out of the results of view within the canvas, helping you adjust the display for better clarity and focus. The same functionality can also be achieved using your mouse controls, offering flexibility in how you navigate and explore the view.
Timeline View
A timeline view in OWL presents investigative data in chronological order, allowing users to track events by specific dates or time ranges. It highlights key actions, involved entities, and data sources, enabling investigators to visualize patterns, identify overlaps, and analyze the sequence of events for clearer case understanding.
Timeline View Features
- With each new data query, OWL analyzes incoming vendor data for any available date ranges or time- based events. When such temporal information is detected, OWL extracts and organizes these events into a structured report, displayed chronologically in the Timeline View. This view presents the same core data as other formats but arranges it by time to help investigators clearly trace the sequence of events, identify patterns, and analyze critical points of intersection that are crucial to the investigation.
- On the left, it displays all vendor responses in a structured format, allowing users to navigate through individual queries and associated identities. On the right, the Timeline Chart provides a chronological visualization of events based on their dates of occurrence, enabling users to trace the sequence of actions over time.
- Any identity containing date attributes—such as Start/End Date or First/Last Seen—will automatically be treated as a timeline event. These events are plotted on the chart, spanning from the specified start date to the end date, accurately reflecting the duration of activity for that identity.
- The Timeline View displays the total number of timelines identified within a search, case, or for each identity. This provides a quick summary of how many temporal events are available for review.
- Users can apply various filters to refine the timeline to display. The view supports multiple time-based filters, including: Decades, Yearly, Half-yearly, Quarterly, Monthly, Daily
- These filters allow for more granular or broader analysis depending on the investigative need.
- A dedicated Date Filter enables users to search for events occurring within a specific date range. Simply select the desired start and end dates, then click Apply to update the timeline. To revert to the default view, click the Reset button.
Geospatial View
The Geospatial View in the OWL Intelligence Platform is an interactive map-based interface used to visualize the locations of individuals, objects, and incidents relevant to an investigation. It enables investigators to track movements, identify patterns, and correlate events across geographic areas. For example, using network data, the platform can plot a person’s location across multiple days, helping trace their movements and uncover potential connections between locations and events.
Geospatial view features
Location Data Input
To display locations on the Geospatial View, OWL requires either geographic coordinates (latitude and longitude) or address details such as Street, City, State, and ZIP code.
Coordinate Mapping
o If latitude and longitude are available in the data, OWL uses them directly to pinpoint the exact location on the map.
o If only address components are provided, OWL automatically geocodes the information— converting it into coordinates—to accurately map the location.
- Location Extraction from Whooster Vendor Data When you perform any type of whooster product searches, if the search response contains address or geo coordinates for individual identity, then these details are automatically prepopulated on the geo- spatial view.
- One Identity may have multiple addresses. By default, OWL shows the recent address of the identity on the geospatial map. If you want to see all the addresses on the geospatial map, you need to do the View all addresses search from identity.
- Go to any identity on the geospatial map, click on the Spyglass icon. If the identity has multiple addresses, then the View All Addresses option will be visible to you. Click on it. You will see all the other addresses on the screen. This feature does not come with the Whooster Edition plan.
- On the geospatial view, you will see the icons that represent a single location. Mouse over the icons will see the details of the identity.
- You can zoom in/out to see all the identities on the geospatial view with their exact locations on the map.
- The default map view is the street view. You can change it using the option available in the lower left corner of the map. You can switch to Street Map/ Light Grey Street/Satellite view, whichever is convenient for you to visualize the data.
On the identity, you have the same options as Spyglass, like other views.
Spyglass – Click on the spyglass button on the identity to open the spyglass menu. The Spy menu contains different options like Show details, Hide Node, download identity reports, and pivot searches.
- Using the pin button on the identity, you can make the identity focused.
- From the spyglass menu, you have options to perform a direct search based on the node data, like SSN, Addresses, Phone Numbers, etc.
- Click on any of these Data to open the Spyglass search pop-up. The pop-up automatically identifies the number of whooster products that can be used with this selected search criteria. You can select the products and click on the Search button to initiate the search.
- Once the search is complete, the page gets loaded, and it will show all the new search results on the screen.
Tabular Report View
The Tabular Report View in OWL is a powerful interface designed to present complex relationship data in a structured, easy-to-read table format. It serves as a central workspace for investigators and analysts to review, edit, and manage case-related information with precision and clarity.
You can enable this view from the ALL-Views option from the result screen if not selected during the search.
Tabular View Features
- The Tabular Report View in OWL adopts a parent-child structure to organize and display data hierarchically. All OWL records are linked to a case—such as Dataset Queries, Vendor, Datasource, or Products; Identities presented in a structured tabular format. This layout ensures that users can easily trace relationships and dependencies between records within the context of a case.
Dataset Queries: In Detail
• Each section inside the Tabular view default is represented in a collapsed structure. You need to maximize each section to see the corresponding data inside it.
• Data Set Queries information can be viewed by expanding the container. The number of products selected to perform a search can be viewed from the collapsed container itself, for a quick check before expanding the container to look for a specific product.
• Click on the plus “+” icon or the container to expand the Case Dataset Queries container.
- Each Whooster Data query node will have the Whooster Vendor node as the child node. Each whooster vendor node will have the Whooster selected products/ Datasource as the child node to the vendor node. Identity nodes from each Datasource will be the child node of the respective Datasource nodes. Hierarchy Structure: Data Query → Whooster Vendor → Datasource → Identities
- Expanding each product data source container will show all the identities associated with it. Each identity is listed according to the type of Whooster products.
- Expanding each identity further will show the identity detail and the data that is found as information for each identity from the whooster vendor.
Each Identity node can have child identities that store detailed attributes related to the parent's identity. These attributes—such as SSN, Addresses, and Phone Numbers—are organized into distinct groups. Each group contains multiple records of the same category, representing different instances of that attribute for the given identity.
Hierarchy Example:
Identity → Child Identity Groups (SSN / Addresses / Phone Numbers) → Records
- From each identity, you have the option to perform Spyglass searches. Main identity has all the records for the identity, which can be further searched within the same case. Also, the child's identities have only records specific to child records that can be used as the spyglass search.
Spyglass search shows the same as the Data Query Search. You can identify the sub search from the tabular view quickly by seeing the icon different from the main search.
Mouse over on the specific Query node shows the node type, whether it is a main search or a pivot search. Also, the Root of the spyglass search.
- You can download individual reports from each identity using the Download PDF/Excel options on the Spyglass search.
- Using the Display All option present on the Tabular view, you can expand both parent and child node containers to scroll and view all the information I the tabular view. Unchecking this will hide all nodes except Data Query Nodes on the tabular view.
- Index button: the tabular view container will show all the available Data Query Search lists, and clicking on it will redirect the user to the same data query search.
From the Tabular view result screen, you can initiate Person Detail and Enhanced Report searches.
Steps to perform a Detail/Enhanced Report search from the Tabular Report View:
- Run a Whooster person search in OWL.
- Navigate to the result screen and select the Tabular view.
- Expand the Data Query Node.
- Locate the relevant identity within the query node.
- On the identity container, you will find a View Report button.
- Clicking this button displays two options: Person Detail Report and Person Enhanced Report.
- Select either option to perform the corresponding search.
- OWL will launch the Detail/Enhanced Report search as a spyglass search and generate a new response.
- Once the page loads, a new query node will appear in the views along with the report details."
Relationship Matrix View
OWL Intelligence automatically analyzes data from query searches to identify relationships between two or more identities across different searches within a case. These relationships are established based on shared or common data attributes between entities.
While these connections are visually represented in the Link Analysis View—with lines drawn between nodes to indicate relationships—the volume of data can make it challenging to explore each link individually. To address this, OWL provides the Relationship Matrix View, which presents all detected relationships in a structured tabular format. This matrix includes relationship scores, allowing investigators to efficiently review, compare, and analyze connections without navigating through each graphical link individually.
Steps to access the Relationship Matrix view
- Launch any Data Query Logs from the My Activity that is linked to any case number. Under the same case, if you have multiple searches with whooster products, then there will be a possibility that you have relationships between nodes. Make sure you launch a data query log that has relationship lines with other searches under a case.
- Once the Query is launched, go to any view on the result screen and check for the Relationship Matrix view tab.
- Click on the tab to open the relationship matrix view on the result screen.
- If there are no relationships present, then this page will be empty.
Relationship Matrix View Features
- Tabular Display of Relationship Data All relationship data is presented in a structured table format. The left-hand panel provides filtering options by identities, allowing users to narrow down the view based on investigative focus.
- Source and Target Record Comparison The right-hand section displays both the source and target records involved in each relationship. It highlights the matched data fields and assigns a relationship score based on OWL’s analysis.
- Relationship Scoring Logic When source and target data match completely, OWL assigns a 100% match score. Partial matches are scored proportionally based on the degree of similarity and relevance between the entities.
- Identity-Level Relationship Selection For targeted analysis, users can select specific relationships from the relationship dropdown or deselect them directly at the identity level to refine the matrix view. To view relationships tied to a specific identity, use the All relations dropdown in the left panel. Selecting a relation will filter the matrix to display only the relationships associated with that relation.
- Editing or Deleting Relationship Records In the Action column of the Relationship Matrix View, users can edit or delete any relationship record. If a relationship score needs adjustment—either higher or lower—click the Edit button, modify the score as needed, and click Save to update the record. This allows investigators to refine relationship accuracy based on contextual insights or new findings.
Data Visualization Manager View
The Data Visualization Manager View is the default interface available on the result screen in OWL Intel. Regardless of the view selected during a search, this view remains active and cannot be deselected. It serves as a centralized, quick-access filter for all dataset records and identities linked to the case and its associated data queries.
Structurally, the Data Visualization Manager View closely resembles OWL’s Tabular Report View, and it inherits all the same functionalities. However, it stands apart with unique features:
• It never hides nodes, even those filtered out in other views.
• Filters applied within the Data Visualization Manager View affect all other views.
Users can toggle between a compact layout and an expanded view, similar to the tabular format, which overlays the result screen without replacing other views.
This view streamlines navigation across records and vendor data, enabling users to search efficiently and perform quick actions. It is included by default in all types of data query searches—whether case-based, subject-based, or temporary—and offers tailored options based on the relationship between records and their parent entities.
Steps to access the Case Manager View:
- Launch any Data Query from the My Activity Searches or perform a new search.
- Once the result screen is loaded, click on the green icon present on the top right corner of the screen next to the All-views option.
- You will see the Data Visualization Manager view open as a side panel view showing all the nodes and records associated in a hierarchical order.
Data Visualization Manager View Features
- By default, all the Data Query Nodes will collapse in the view.
Clicking on each Data Query Node will expand the node, and you can view all the Data Query Search details. The hierarchical order of the nodes is as follows:
Data Query → Whooster Vendor → Datasource → Identities
Show Details:
In Link Analysis or Geospatial view, the full identity details are not available in a report format. To access them, use the Show details option from the spyglass menu of the specific identity node. This will open the Data Visualization Manager and take you directly to the exact identity or sub-identity you need. With this feature, you can seamlessly switch between views while verifying data simultaneously.
Pin/Unpin Identity:
During an investigation, the result screen may display a large volume of data, much of which may not be immediately relevant. To streamline your workflow and focus on key identities, OWL Intel allows you to pin specific nodes or wrapper nodes from any view.
Pinned items appear above the Data Visualization Manager View, making them easily accessible each time you launch the case. This ensures that critical identities remain visible and quickly reachable.
If you wish to remove a pinned item, simply navigate to Data Visualization Manager View and click the Unpin icon next to the node. Clicking on a pinned identity will automatically scroll in the Case Manager View to highlight the corresponding node in both the Tabular and Case Manager views.
Expand/Collapsed View:
Data Visualization Manager View can be expanded to a larger view, similar to the Tabular view, by clicking on the double arrow options.
You can open and collapse the expanded view using the green collapse icon on the Data visualization manager view.
Data Visualization Manager Filter:
Clicking on the filter option present on the top right corner of the Case Manager view will show the node types, like in other views' filter. Select/Unselect these filter options will apply the same filter in all views. Only selected nodes will be visible in all views.
Common Features in All Result Screen Views
1. Node Filters
The Node Filter is a shared feature available in both the Link Analysis View and the Tabular Report View. It allows users to filter displayed nodes based on their type, streamlining the investigation process.
- Default Behavior: All node types are unselected by default, giving users full control over what they wish to view.
- Query Node Filter: Choosing the Query Node filter will display Query nodes only, while hiding the rest.
Vendor, Data Source, and Identity Filters:
- Vendor Node: Displays nodes up to the vendor level.
- Data Source Node: Displays nodes up to the data source level.
- Identity Node: Displays nodes up to the identity level.
This hierarchical filtering helps investigators focus on specific layers of data, reducing visual clutter, and improving analytical clarity.
2. New Search from the Result Screen
OWL Intel enables users to seamlessly access various search functionalities directly from the results screen. The New Search menu provides quick links to three distinct search types: Product Search, Keyword Search, and Geospatial Search.
Steps to Access Search Pages:
- Go to any view from the Result Screen page. Go to the menu located in the top right corner of each view and click on it.
- Hover over the “New Search” option.
- A submenu will appear displaying three links: Product Search, Keyword Search, and Geospatial Search.
- Click on any of these options to be redirected to the corresponding search page.
3. Print View from Result Screen
OWL Intel allows users to print specific views directly from the results screen. This feature is available for Link Analysis, Timeline, and Geospatial views only.
Steps to Print a View:
- Go to the Link Analysis View/ Timeline View/ Geospatial View menu.
- Click on the “Print View” link.
- A pop-up window will appear displaying the selected view data.
- Use the available action items within the pop-up to adjust the view as needed.
- Once finalized, click the Print button to generate a printed version of the view
Link Analysis View Print View:
Geospatial Print View:
Timeline Print View:
4. Download PDF & Excel Report from Result Screen
- OWL Intel allows users to generate and download PDF and Excel reports directly from the results screen. These reports include detailed Data Query Searches performed within the case.
- By default, the downloaded report contains all query search details and associated records. However, users can choose to download only a specific identity by selecting individual identity nodes from the Data Query Search results screen. Export buttons are available for each node within the Tabular and Timeline views, enabling selective record downloads.
- Additionally, in the Link Analysis View, users can download PDF or Excel reports for a specific identity using the Spyglass menu available on each identity node.
Steps to Generate and Download the PDF Report:
- Go to any view from the Result Screen page. Go to the menu located in the top right corner of each view and click on it.
- Click on the “Download PDF Report” or “Download Excel Report” option.
- A pop-up will open to password-protect the document.
- If you choose to protect the document, then you need to provide a custom password or autogenerate a password from OWL.
- Enter your password into the password field and make sure you enter a password with at least 8 characters to enable the Export button.
- If you want to generate a password, click on the Generate Password option. A password will be added to the field, and the export button will be enabled.
- If you have selected a specific node directly from the Link Analysis view, then you will see the pop-up to protect the PDF only.
- Click on the Export button to export the PDF/Excel report accordingly.
- An email will be sent to the respective user with the password set during downloading the report.
- A PDF report will be automatically generated and downloaded via the browser.
- By default, the file will be named after the case (e.g., “Case Name.pdf”) if you have downloaded all the Query Data results together. If you download a report for an individual identity, then the name would be the “identity name.pdf”.
Related to