HORNETSTRIKE

Methodology

From data to defensible intelligence.

Bring sources, analysis and human review into one traceable investigation workflow. Each finding retains its context and level of confidence.

Detection creates a lead. Corroboration develops intelligence. Provenance and lawful handling support evidence.

Sources, leads, assessed intelligence and findings remain linked to provenance and human review. Process diagram.

The stack

Distributed collection. Unified investigation.

Analytical findings remain subject to human validation, with their sources, confidence and review history available to the investigator.

  1. 01 · Collection

    FalconOne

    Lawful, authorised collection across telecommunications, radio-frequency, field and remote environments — where legal authority, network cooperation and technical access exist.

  2. 02 · Processing

    Obala

    Ingests data from FalconOne, agency systems, open sources, sensors and partner feeds. Validates, normalises and correlates it using GPU-accelerated analysis in a locally controlled environment.

  3. 03 · Investigation

    HornetStrike

    Connects processed information to cases, people, devices, vehicles, organisations, locations, transactions and events. The investigator decides.

  4. 04 · Decision

    Human review

    Authorised analysts validate findings, assess confidence, record the decision and determine the response.

Analytical method

All-source analysis. Traceable findings.

  1. 01

    Define the question

    The person, organisation, event, threat, device or transaction under examination.

  2. 02

    Assess the source

    Access, reliability, recency, bias, technical limits and exposure to deception.

  3. 03

    Prepare the data

    Formats, time zones, duplication — every record keeps its link to source.

  4. 04

    Resolve entities

    Names, numbers, devices, accounts, vehicles and addresses that may be the same subject.

  5. 05

    Correlate

    Identity, time, location, communications, finance, cyber infrastructure and known events.

  6. 06

    Test alternatives

    Evaluate innocent, contradictory and competing explanations alongside the initial hypothesis.

  7. 07

    Assign confidence

    Gaps, assumptions, contradictions and what still has to be collected.

Seven stages

Authorise to retain.

  1. 01

    Authorise

    Lawful authority, objective, scope and the intelligence requirement.

  2. 02

    Collect

    FalconOne, agency systems, OSINT, devices and partner feeds.

  3. 03

    Preserve

    Originals protected. Integrity, provenance and custody recorded.

  4. 04

    Process

    Obala digitises, normalises, deduplicates and prepares the set.

  5. 05

    Correlate

    People, devices, locations, vehicles, transactions and events.

  6. 06

    Validate

    Analysts assess confidence and decide the response.

  7. 07

    Report

    Record the findings and decision, with retention governed by policy.

Authorised integrations

Connect the source to the case.

Obala integrates APIs, databases, secure transfers, queues, sensors, legacy systems and controlled offline imports. Custom parsers support formats specific to the operation.

  • 01Government databases and departmental systems
  • 02Case, intelligence and records-management systems
  • 03ISPs, telecommunications and authorised network metadata
  • 04Population, company, property and vehicle registries
  • 05Financial institutions, transactions and AML platforms
  • 06Blockchain and virtual-asset intelligence
  • 07Border, immigration and travel systems
  • 08LPR, CCTV and authorised face-matching
  • 09Geospatial, mapping and location sources
  • 10Cyber, breach, deep-web and dark-web feeds
  • 11Device forensics and seized-media outputs
  • 12FalconOne nodes and partner-agency feeds

Access to classified, communications or personal information stays subject to mandate, warrants, compartment controls and agency policy. Message content is not collected.

Training information is available through ScaryByte Academy (opens in a new tab)

What the investigator sees

One subject. A connected case file.

Request a briefing

Example case

One identifier. The linked record.

Fictional sample records. No live search is performed.

RSA ID number

87••••••••087

6 disciplines · 27 findings · 1 subject

Sample data · RSA ID number

Sample record groups

Disciplines

  • TECHINT
  • OSINT
  • SOCMINT

Subject

D•••••• M•••••

Male · 38 · South African

People

  • Mother
  • Brother
  • Spouse

Locations

  • Residence
  • Property 02
  • Property 03

Sample locations · 3 sites linked

LAT -26.2041 · LON 28.0473

  • Residential address
  • Property 02 · registered
  • Property 03 · registered

Subject dossier

D•••••• M•••••

Male · 38 · South African

Record context

Biometric + document cross-check

National ID
87••••••••087
Passport no
A0•••••8
Smart card
Issued 2019 · valid
Date of birth
1987-••-••

Record details

Current
Logistics director · 6 yrs
Prior
4 roles · 2009–2019

Source context

Sample date
2026-08-22
Corroborating
6 independent

TECHINT

HLR / MNO

Carrier
MTN South Africa
MSISDN state
Active · ported 2023
Roaming
Not roaming · ZA
Line type
Post-paid contract

OSINT

Email addresses

Listed
3 addresses
Primary
d•••••@gmail.com
Work
d•••••@••••.co.za
Exposed
1 in breach data

SOCMINT

Social profiles

Matched
4 platforms
Handles
Instagram · X · TikTok
LinkedIn
Employer listed
Last active
2026-08-19

Associated records · 3

  • Mother

    N••••• D•••

    Shares residential address

  • Brother

    S••• D•••

    2 shared company records

  • Spouse

    A•••• D•••

    Joint account holder

FININT

Financial profile

Accounts
3 institutions
Directorships
2 active companies
Property
2 titles registered
Sanctions / PEP
No match

DARKINT · Breach exposure

4 corpora matched · 11 records · earliest 2019-01-07 · plaintext credentials present

OP-14 · Sandton desk · Lawful investigation · POPIA s11 · sha256:7f3a…c91eSample audit record