Event-Based Analysis
Overview
Event-Based Analysis finds which entities were present in a geographic area during specific time windows. You draw one or more event polygons on a map, set a time range for each event, select an analysis preset, and run the analysis to discover subjects such as people, devices, or vehicles. Outputs include a paginated subject list with reasoning chains, plus optional subject position history on a map and timeline. Results depend on configured reasoning paths and require review before you treat presence as confirmation.
When to Use This Application
- You need to identify who or what was present at a location during a defined time window.
- You need to compare multiple events and find subjects present in all of them.
- You need to run a preset investigation strategy (for example “Find People” or “Find IMEIs”) without writing queries.
- You need to save events and results to a Workspace so other analysts can review them.
- You need map and timeline views for detections tied to a reasoning chain.
Before You Begin
- Ensure position-style geo-event data is available in Octostar for the area and time windows you plan to analyze.
- Confirm you have access to the destination Workspace folder where you will save event files and results.
- Confirm presets are configured and available. Presets are defined in
config.yaml. - If you plan to visualize subject positions after analysis, avoid changing
config.yamlpaths between running and visualizing the analysis.
Step-by-Step Walkthrough
Step 1 — Choose create mode or load mode
Use the Start Analysis section in one of two modes:
| Mode | Purpose |
|---|---|
| Create | Define new events by drawing polygons and assigning time ranges |
| Load | Load previously saved .ebas event files from a workspace |
Step 2 — Create events (create mode)
| Step | Action | Details |
|---|---|---|
| 1 | Draw a polygon on the map | Use the drawing tools to draw one or more polygons for the event. |
| 2 | Set the time range | Select start date/time and end date/time. |
| 3 | Select a preset from the dropdown | Presets define which tables and reasoning paths the analysis uses. |
| 4 | Preview the event | Select the preview action to see how many positions match your polygon and time range. |
| 5 | Add the event | Enter an event name and add it to the event list. |
Repeat these steps to create multiple events.
Step 3 — Load events (load mode)
Load events when you already have .ebas files saved in a workspace.
| Step | Action | Description |
|---|---|---|
| 1 | Browse workspace folders | The app lists folders that contain .ebas files. |
| 2 | Select a folder and load its events | Loaded events appear in the same event list used in create mode. |
After loading, run the analysis using the same steps as create mode.
Step 4 — Run the analysis
Select one or more events from the event list and select Run.
The app can run analysis in two ways:
| Mode | Use when |
|---|---|
| In-app execution | You want to monitor progress live |
| Background job | The analysis is expected to run longer |
Use in-app execution when you want to monitor progress live. Use background execution for longer runs.
Step 5 — Visualize results
Open the Visualize Results section to explore the output.
Load an analysis to visualize
Use the dropdown at the top of the page to choose what to visualize:
- In-app results from the most recent run
- Saved
.ebafiles found in your workspaces
Browse subjects
After the analysis loads, the app shows a paginated list of subject cards. Each card includes:
| Element | Description |
|---|---|
| Label and type | The subject label and concept type |
| Event chips | Events in which the subject appears |
| Tags | Classification tags |
| Identifiers | Raw identifiers linked to the subject |
| Reasoning chain | The ontology path connecting the geo-event to the subject |
Use pagination controls to move through results.
Filter subjects
Use filters to narrow the subject list:
- Event selection using event chips
- Subject concept type
- Identifier concept type
- Label regex
- Identifier label regex
- Event label regex
- Reasoning regex Event chip filtering shows only subjects present in all selected events.
View subject positions (map and timeline)
Expand a subject card to load position history:
- Map view showing the geo-event locations where the identifier was detected
- Timeline chart showing detections over time
Position retrieval depends on
pathsinconfig.yaml. If the analysis reasoning chains do not match currentpaths, the app shows a warning and does not load positions.
Understanding the Output
Event-Based Analysis produces several related outputs.
| Output | Description |
|---|---|
| Event list | A list of named events, each defined by one or more polygons, a time range, and a preset. |
| Subject list | A paginated list of discovered subjects (people, devices, vehicles, and other concept types). Each subject includes identifiers and a reasoning chain. |
| Event chips | Colored indicators that show which events a subject appears in. Use chips to filter to subjects shared across events. |
| Reasoning chain | The ontology path used to connect a raw geo-event to the subject (for example position_of_identifier → phone_number → is_owned_by → legal_person). This explains why the subject appears in results. |
| Subject position history | A map and timeline for detections, when path matching succeeds. If config.yaml paths change after analysis, position history may not load. |
Saving and Exporting Results
You can save both the defined events and the analysis output to a workspace folder.
| Save option | What it does | Destination | Settings |
|---|---|---|---|
Save events as .ebas files | Saves each event as an individual .ebas file | Selected workspace folder | Folder path |
Save analysis results as .eba archive | Saves analysis output as a single .eba file for later visualization | Selected workspace folder | Folder path, filename |
This makes it easier to reuse event definitions or hand off results to another analyst.
Tips for Best Results
- Create events with precise polygons. Large polygons increase noise and reduce interpretability.
- Use separate events for separate places or time windows, then use event chips to find intersections.
- Preview each event before you add it to confirm the time window and polygon match expected record counts.
- Select presets that match your investigative goal. Presets control which tables and reasoning paths are active.
- Keep
config.yamlpaths stable between running an analysis and visualizing positions from that analysis. - Use regex filters to narrow subject lists when labels vary in formatting.
Known Limitations
| Limitation | Explanation |
|---|---|
Results depend on presets and reasoning paths defined in config.yaml. | Misconfigured paths reduce recall or produce incomplete subject sets |
Subject position history can fail to load when config.yaml paths change after analysis | Stored reasoning chains may no longer match the current configuration |
| Presence does not confirm identity | A result indicates a configured reasoning-path match, not proof |
| Large event sets can reduce usability | Broad presets and many events may produce very large subject lists |