Every data source, one ontology, four ways to investigate it.
Nekroi is built around a single idea: unify data first, investigate second. Everything else, the graph, the map, the timeline, the action layer, reads from and writes to the same underlying model of your entities and their relationships.
Ontology-driven, not ad hoc.
Instead of one-off queries against disconnected systems, Nekroi maps every source into a shared, typed model of people, organizations, events, documents, and however many other entity types your domain requires. The schema is yours to define and evolve, and every record entering the system is validated and normalized against it before it becomes part of the investigative picture.
- Structured, unstructured, and streaming sources, connected through repeatable, versioned pipelines
- Full provenance on every value: which source, which pipeline, when, and with what confidence
- Temporal awareness built in, so the system can reconstruct what was true as of any past date
Know when two records are the same thing.
Deterministic matching on hard identifiers, probabilistic matching on names, addresses, and dates of birth, and a review queue for anything in between. Merges and splits are always reversible and always audited.
Graph, map, timeline, and table, kept in sync.
Select an entity in any view and every other open view responds immediately. An analyst can move from a relationship graph to a map to a timeline without losing their place or re-running a search.
Graph
Force-directed, hierarchical, and temporal layouts for exploring relationships and finding non-obvious connections between entities.
Map
Clustering-aware geospatial views with timeline scrubbing, so movement and location patterns become visible at a glance.
Timeline
Swim lane views of events, property changes, and relationship history, with playback to observe how a situation developed.
Table
Dense, sortable, exportable views of any result set, with saved column configurations and bulk actions.
From finding to outcome, in the same tool.
Analysts do not need to leave the investigation to act on it. Defined actions, flag a transaction, open a task, notify a team, execute directly from the object being investigated, with parameters, confirmation, and a permanent audit record.