Define the claim and its variants
Write a precise version of the assertion being traced. Record translations, paraphrases, images or links that may represent the same underlying claim, while keeping meaningful differences visible.
When comparing narrative threat intelligence solutions, ask each provider to demonstrate a timeline and explain the evidence behind every type of network connection.
A search that matches only identical words can miss a changed version. A search that groups every related topic can erase the distinction between a claim, a rebuttal and a discussion about the claim.
Construct an observation timeline
Record source, author or account identifier, content, publication time, capture time and the relationship to an earlier observation. Normalize the time zone for analysis while retaining the original timestamp where available.
Mark inaccessible sources and uncertain dates. If the available record starts after a story was already circulating, say so. Do not fill the gap with a guessed starting point.
Label the connections on the map
| Connection | What it can show | What it does not establish alone |
|---|---|---|
| Shared source link | Accounts reference the same item | Common ownership or instruction |
| Quote or repost | An observable publication relationship | Agreement with the original claim |
| Similar wording | A repeated text pattern | Why the wording is shared |
| Account connection | A specified public relationship | Control of one account by another |
Distinguish visibility from influence
An account with a large audience is not necessarily the source that caused a particular claim to spread. Identify the evidence for the role you assign: early publication, repeated redistribution, bridging communities or mainstream pickup.
Label reach or engagement measures as observations or estimates with their source and limits. Avoid translating potential exposure directly into a count of people persuaded.
Write the conclusion at the right level
A defensible conclusion might describe the earliest observed examples, the main route visible in the dataset and important gaps. Attribution to a directing organization needs additional evidence beyond a map of public repetition.
Keep an evidence index beside the visualization. Another analyst should be able to inspect a selected connection, reproduce the underlying observation and understand any uncertainty.
Questions for the brief
Can the first post returned by a search be called the origin of a narrative?
Call it the earliest observed instance within the stated sources and search window unless stronger evidence establishes origin. The search may omit deleted, private, unindexed or earlier material.
How do I handle the same claim in several languages?
Preserve the original wording, explain the translation and record which elements support grouping the versions. Use a qualified reviewer where meaning or local context could materially affect the analysis.
What should I ask when a platform shows a network diagram without explaining the lines?
Request a definition and source evidence for each edge type. A map is difficult to interpret if quotation, shared links, timing similarities and asserted organizational relationships all look identical.