The gap you can't see: turning missing links into collection tasks
Investigations obsess over the evidence they have. The bigger prize is often the evidence that should exist but doesn't — and knowing to go get it.
Most analysis focuses on the data in front of you. But some of the most valuable intelligence is negative: the communication that should be there and isn't, the transaction the pattern predicts but the records don't show, the movement that the rest of the network implies.
These gaps are hard to see precisely because they are absences. A human analyst, working through what exists, rarely notices what is missing — there is no record to draw attention to itself. Yet a missing link between two otherwise-connected subjects is often the single most important thing to collect next.
CLERINT flags these gaps by reasoning about the shape of the network. When two subjects are tightly connected through several paths but lack a direct link the pattern expects, the system surfaces that absence — and turns it into a concrete collection task: request the CDR, pull the transaction history, task the sensor.
This inverts the usual workflow. Instead of an analyst deciding what to collect and hoping it helps, the graph tells the team where its own blind spots are and what would close them. Knowing what you don't know — precisely — is a capability, not a limitation.