About the Intelligence tools
The Intelligence tools help you find patterns across incidents and cases: before a case exists and while one is being worked. This section covers the surfaces that live outside a single case:
- Incident Connections review: a queue of AI-proposed connections between incidents, for a reviewer to confirm or dismiss in bulk. See Review incident connections.
- Event Link Analysis and the research page: pick one incident and see the incidents connected to it as a graph. See Analyze incident links.
- Cluster review: decide whether a cluster of connected incidents becomes a case. See Review and promote clusters.
- Connections Lens: ask about connections and incidents in plain English. See Ask the Connections Lens.
(The case network graph, which works inside a single case, is covered in the Cases section: see Work with the Network tab.)
Where connections come from
Every incident is automatically compared against others when it is saved, imported, or edited, and sufficiently similar pairs are stored as proposed connections. All of these surfaces read those stored connections. How two incidents are scored, the signals and their weights, is the same platform-wide, and a pair must reach a score of 70 to be stored at all (a shared license plate alone scores 90). See Link and connect incidents for the scoring summary.
Who can reach what
| Surface | Roles that can open it |
|---|---|
| Incident Connections review queue | Platform Administrator, Administrator, Supervisor, Managers, ORC Analyst, Investigator |
| Event Link Analysis / research page | Platform Administrator, Administrator, Supervisor, Managers, ORC Analyst, Investigator, Store Coordinator, RAPM, DAPL |
| Cluster review | Administrator, Supervisor, Managers, Investigator, Store Coordinator, RAPM, DAPL |
| Connections Lens | Administrator, Supervisor, Managers, ORC Analyst, Investigator, Store Coordinator, RAPM, DAPL |
Notes worth knowing: Platform Administrators can open the analytical pages but make no changes anywhere in Intelligence, and cannot use the Connections Lens at all. Auditors, Viewers, and External Partners do not reach the standalone Intelligence pages. Store Associates reach none of them. Everything here is confined to your own organization, and case-derived content obeys the category rules of the Chinese Wall.
The Intelligence tools depend on your organization being entitled to both Incidents and Cases: incidents are their only input and cases their only output, so if either is withdrawn the whole area goes dark.