An interactive D3 visual analytics tool for VAST Challenge 2026 Mini-Challenge 1.
TenantThread, a property technology company, signed an embargoed merger agreement with CivicLoom Realty Partners under the codename Project HarborCrest. The announcement was not meant to become public until 6:00 PM on June 5, 2046, but automated accounts associated with TenantThread began releasing information on FleX around 5:00 PM.
The challenge is to investigate TenantThread's internal agent communications from the two weeks before the breach and determine how the release passed the embargo controls. This includes reconstructing the key events, actors, decisions, and relationships; comparing breach-day activity with normal behavior; and identifying earlier warning signs or similar behavior.
The dashboard combines a message timeline, a candidate causal graph, and agent behavior comparisons. Together, these views help investigators move from a broad behavioral pattern to the exact messages supporting it. Filters for agents, communication actions, dates, and breach-related keywords support focused investigation.
The timeline places messages in chronological order across agent lanes and rounds. It shows who communicated, when they communicated, and which channel or action they used. Investigators can filter the data, focus on the June 5 breach day, inspect exact messages, and follow supported reply or reference links between events.
The causal graph presents a candidate chain of events leading to a selected outcome. Nodes represent messages, actions, or decision points, while links describe supported relationships such as direct replies, agent references, state transitions, and indirect influence. The graph helps explain how an outcome may have developed, but inferred links should be treated as investigative leads rather than proven causality.
The bar chart compares each agent's public-posting activity during the baseline period with activity on the breach day. It highlights agents whose behavior changed most sharply and provides risk scores, rankings, key findings, and example messages for closer inspection.
The heatmap compares baseline and breach-day activity for each agent and communication channel. Its colors indicate the size and risk level of behavioral changes across comms huddles, side huddles, official posts, personal posts, and anonymous posts. Selecting a cell filters the timeline to the corresponding agent and channel.
The evidence panel on the right updates when an item is selected in any view. Timeline selections show exact message details and supported thread links. Causal selections explain the selected event or relationship and the evidence behind it. Bar-chart and heatmap selections show behavioral metrics, risk scores, changes from baseline, findings, and example messages. This keeps the underlying evidence visible while moving between overview and detail.
From the project directory, start a local web server:
python3 -m http.server 8000Then open http://localhost:8000 in a web browser.
If port 8000 is already in use, choose another port:
python3 -m http.server 8001Then open http://localhost:8001.
Stop the server with Ctrl+C in the terminal.
index.html- dashboard structure and layoutscript.js- timeline, filters, causal graph, and evidence interactionsview3.js- agent behavior bar chart and channel risk heatmapstyle.css- visual stylingMC1_final_00.jsonanddata/- source and derived data