From a single lead to a full picture: how entity resolution works
A name, a handle, a wallet. Entity resolution is what turns one identifier into a person — and one person into a network. Here's what's happening under the hood.
Give an investigator a single identifier — a name, a handle, a phone number, a wallet address — and the first job is deceptively hard: decide what, and who, it actually refers to. Entity resolution is the discipline of collapsing many observations into the smallest set of real-world entities they describe.
The naive approach is exact matching: two records with the same email are the same person. Reality is messier. People reuse handles, misspell their own names, share devices, and deliberately obscure their footprint. Good resolution reasons over fuzzy, probabilistic signals — co-occurrence, timing, shared infrastructure — and assigns a confidence to every merge rather than pretending to certainty.
In CLERINT, resolution is what makes the graph coherent. When OSINT surfaces a social profile, Media recognises a face, and Fusion holds a call-detail record, resolution decides whether those three observations belong to one node or three. Get it right and the network snaps into focus. Get it wrong and you either miss connections or invent them — both dangerous.
That is why every resolved entity carries a quality score and an evidence trail. An analyst can see not just that two records were merged, but why, and with what confidence — and can split them again if the evidence is thin. Resolution is a hypothesis, not a verdict, and the system treats it that way.
The payoff is the pivot. Once a lead is resolved to an entity, every source that touches that entity becomes reachable from a single node. One identifier becomes a person; one person becomes their accounts, their contacts, their movements and their money — the full picture, assembled from parts that were always there.