Databricks Community

niteshm · a week ago

MuleGraph Investigator

From One Alert to the Hidden Network

How a Databricks App turns a single flagged account into a fully-traced fraud network - with Genie doing the actual investigating, not just the talking.

Find the network before the money moves

1. The Problem

Banks see thousands of "money mule" accounts every year, accounts that quietly collect stolen or scammed money from multiple victims and forward it onward before anyone notices. A single flagged transaction almost never tells the whole story. By the time a human investigator manually traces the connections by hand pulling transaction logs, cross-referencing device IDs, building a spreadsheet of who-paid-whom the money is often already gone.

MuleGraph Investigator starts from exactly that moment: one flagged account. A "simple suspicious transfer" scenario in which a single collector account receives recurring transfers from 5 distinct source accounts and forwards funds to 3 distinct destination accounts, month after month, crossing a total-outbound-flow threshold that a rules engine would catch but a rules engine stops there. It flags the account's aggregated pattern, not a single transaction. It does not tell you who else is involved, whether the same device shows up elsewhere, or whether the money you're looking at is the tip of a much larger network.

The pattern is deliberately shape-based, not label-based. Detection looks for fan-in from 4+ sources, a recurring fan-out to 3+ destinations across 3+ months, and total outbound flow over $20,000. The same shape a legitimate high-volume remittance business can produce. That collision is the whole reason the app exists: catching the pattern is easy; not punishing an innocent customer for it is the hard part.

2. Who It's For

MuleGraph Investigator is built for a front-line fraud investigator. The person who opens one flagged account and must decide, with evidence, what happens next. Home page's hero card frames the highest-priority case, a potential pattern, and an "INVESTIGATOR'S QUESTION" displayed alongside it opening that case. Inside the Investigation Workspace, an "Alert Queue" of active, prioritized cases with an "Open case" button appears whenever no case is currently selected.

The workflow is scoped to exactly one investigator's decision point: one case at a time, one seed account, one evidence policy selected at a time. Every answer is citation-backed so it can support a real investigative decision, not just decorate a dashboard. Nothing in the app takes automated action against an account. It only prepares the evidence, the fund flow, the shared devices, the connected accounts, the potential victims for a person to review and act on.

3. How MuleGraph Investigator Works

You land on a home page that already tells you where to start: the highest-priority alert. Click into it, and instead of one transaction, you see a whole case, a risk score, dollar exposure, how many other accounts are tied to it, and a chat panel where you can just ask Genie what happened.

The navigation is a two-level structure: Home and Investigation Workspace, toggled from the top bar. Home renders a hero card for the single highest-priority case, a row of scenario chips for all nine cases, and four process cards that describe the investigation journey. Home does not show the Alert Queue itself, that list lives inside the Investigation Workspace, and only renders there when no case is currently selected.

Home and Investigation Workspace

Opening a case, switches to the Investigation Workspace, which shows:

A case header — account ID, risk band, "Flagged for investigator review" / "Not flagged" framing.
A KPI strip — six metrics: Risk band, Linked exposure, Connected accounts, Potential victims, Shared devices, External destinations.
Five section tabs — Overview, Investigation, Money Flow,Network, Reports , plus a persistent Ask Genie panel alongside them.

The Overview tab offers three action buttons — Trace Funds, View Connected Accounts, Investigate with Genie, that jump straight into the relevant tab or chat question. Investigation exposes the strict/permissive evidence-policy toggle plus a collapsible legitimate control-cohort audit view. Money Flow lists the policy-scoped transfers and a monthly bar chart. Network renders a live relationship graph and a connected-accounts table. Reports builds a citation-backed case file with a downloadable export.

4. Application Architecture & Data Flow

The data is produced once, by a deterministic raw data and Lakeflow jobs, and the resulting tables are written to Unity Catalog. Everything downstream, the Streamlit UI and the Genie Space, reads from that same persisted source of truth through two independent paths.

The app's own inline comment captures the design intent behind that shared source:

"Every number - strict or permissive - comes from the same eight Gold tables, so the UI, the export, and Genie can never quietly disagree."

That's an intent the architecture is built to hold, not a guarantee enforced by one code path: the Streamlit UI recomputes each case's network locally from the Gold tables , Genie is prompted, not code-enforced, to query only the matching policy scoped view for the selected policy, and the shared-source design is what keeps those two paths, plus the export, pointed at the same eight tables in practice.

5. Complete Technology Stack

Technology	Role in MuleGraph Investigator
Unity Catalog	Governs the mulegraph.investigations catalog/schema
Delta Lake tables	The 8 persisted Gold tables. The single source of truth for both the app and Genie.
4 policy-scoped views	Keep Genie from ever answering from the wrong evidence-policy population.
Databricks SQL Warehouse	Executes the statements in src/data_access.py via the Statement Execution API; Also the compute Genie itself queries against.
Genie Space (Conversations API)	Answers natural-language investigation questions, scoped to the 8 tables + 4 views.
Databricks Apps	Hosts the Streamlit process
Databricks Asset Bundles	Its SQL-warehouse resource, and its Genie Space resource as bundle-managed infrastructure.
Streamlit	The UI framework
Graphviz	Renders the live relationship graph on the Network tab from policy-scoped edges.
Databricks Free Edition	The deployment target documented end-to-end in Databricks Free Edition.

6. Genie at the Core

Genie in MuleGraph Investigator is not a chatbot bolted on top of a finished dashboard, it's a real call to the Databricks Genie Conversations API, and the app is written so it visibly needs that call to succeed. The clearest proof of Genie's centrality is a feature built to demonstrate its absence.

The Investigation Workspace's Genie panel carries a toggle:

🔌 Disable Genie — Demonstrate Dependency

Flip it, and the app is explicit about what breaks:

"Genie conversational tracing is unavailable while the dependency is disabled. The KPI strip, Investigation, Money Flow, Network, and Reports remain live."

That is the honest boundary of what Genie does versus what the rest of the app does. The KPI strip, the policy-scoped Evidence tab, the Money Flow chart, the Network graph, and the Reports export all keep working from the same persisted Gold tables, because they read data_access.py directly. Only the analytical conversation "why was this flagged," "what would we have missed," "why isn't the control cohort flagged" goes away. That's the app proving, in one toggle, exactly which part of the experience Genie owns.

7. What Users Can Ask Genie

These are the real suggested questions shown in the Ask Genie panel, each grounded in the persisted Gold tables and the policy-scoped views:

Why was `ACC_M_COLLECTOR` flagged?
How many inbound sources / outbound destinations does it have?
Compare permissive vs. strict exposure, connected accounts, shared devices.
Which evidence disappears under the strict policy?
Which accounts are connected under the selected policy?
What transfers contribute to the linked exposure?
Why are control-cohort accounts not flagged?
How fresh is this data?
What would we have missed investigating only the original transaction?

The panel also chains follow-up suggestions after each answer. For every other question, including anything typed into the free-text chat box, falls back to redisplaying the full original nine-question list above.

8. Application Experience

Home. A hero card frames the highest-priority case as an investigation brief,suspicious account, potential pattern, an "INVESTIGATOR'S QUESTION" shown alongside it, with two calls to action: Open highest-priority case → and Ask Genie a question. Both buttons do the same thing: they open that case in the Investigation Workspace. Neither one queues the displayed question into the chat input, so the chat still starts empty, waiting for whatever the investigator actually asks. Below the hero, a row of scenario chips lets you jump directly into any of the nine cases, and four process cards narrate the journey: Select the Signal → Investigate with Genie → Follow the Money → Assess the Impact. Home never shows the Alert Queue itself, that list lives inside the Investigation Workspace.

Home hero card with featured investigation case

Investigation Workspace. Selecting a case (from the hero card, a scenario chip, the Alert Queue, or the account selector) opens the full workspace: case header, KPI strip, and the five section tabs alongside the persistent Ask Genie panel. If no case is selected yet, this same view shows the Alert Queue instead - active, prioritized cases with an "Open case" button for each.

Follow the Money - the Money Flow tab. Policy-scoped transfers touching the case network, plus a monthly bar chart of transfer amounts - the visual answer to "where did the funds go."

Money Flow tab - monthly transfer bar chart

Connected Network - the Network tab. A live Graphviz relationship graph drawn directly from the policy-scoped edges, each edge labeled with its type and dollar amount, plus a connected-accounts table below it (account ID, cohort, role, tenure, risk band).

Network tab - relationship graph and connected accounts table

Impact and Insights. The KPI strip (Linked exposure, Connected accounts, Potential victims, Shared devices, External destinations) is the constant header across every tab, and the Reports tab turns the same numbers into a citation-backed case file — every line traceable back to a specific Gold table row, correctly scoped to the selected case's own network (the export now shares views.case_evidence with the Evidence panel, and selects its case_summary row by matching the actual seed account rather than defaulting to the first row) — with a one-click case-file export.

Reports tab - case file export with citations

9. What I Learned

A guardrail has to prove itself behaviorally, not by lookup. The recurring corridor override that protects legitimate customers is re-derived per account from tenure and recurrence facts alone. Never by checking cohort membership directly. A special-cased known control-cohort account IDs would have hidden a real false-negative risk: A genuine mule account with faked tenure metadata slipping through undetected. Only a behavioral rule, applied uniformly, catches that.

A Genie Space doesn't auto-resync its schema. After changing the Gold table schema or rerunning the data-generation notebook with different scenario counts, Genie Spaces snapshot table/column metadata at attach time and do not automatically detect schema changes on an already-attached source. The fix is manual, reopen the Space, go to Configure data, and re-select/re-save the affected tables and all 4 views before retesting.

SDK error surfacing needed an explicit second call - with a fallback of its own. The Databricks SDK's OperationFailed exception from a failed Genie conversation doesn't carry the structured failure reason on its ow. So, specifically when message_waiter.result() raises OperationFailed, genie_query() calls workspace.genie.get_message() separately to retrieve the message's error.type (e.g. TABLES_MISSING_EXCEPTION) and error.error detail, then wraps both into the RuntimeError the UI displays. If that second call itself fails, or returns nothing structured to report, genie_query() re-raises the original OperationFailed rather than hiding it behind a worse error. Without the enrichment call succeeding, a failed Genie query in production would usually show only a generic "OperationFailed" with no actionable detail.

A toggle is a more convincing proof than a slide. Rather than claiming Genie is essential, the app ships a literal "🔌 Disable Genie — Demonstrate Dependency" switch that turns off the live Conversations API call and shows, in real time, exactly what stops working (the analytical Ask Genie answers) and exactly what keeps working (the KPI strip, Investigation evidence, Money Flow, Network, and Reports, which all read the Gold tables directly). That distinction, between the persisted-data experience and the conversational-reasoning experience is the clearest way to show a judge, or an investigator's manager, what Genie is contributing.

An alert tells us something may be wrong. MuleGraph Investigator uses Genie to help investigators understand why, follow the money, uncover connected activity, and understand the potential impact.