Learn more about the Graph Search query results.
Prerequisite
Graph Search requires View or View/Edit RBAC permissions for Graph Search under → .
Review the following topics:
Once the query is completed, you can search for your query results. The results displayed are dependent on your data.
You can view the Graph Search query results in two formats:
Graph (default): Displays the paths on the graph that matched the node types and conditional attributes in the query. Each result is a full path of the matching query.
Table: Displays the results in a table, where each row in the table represents a different path in the graph that goes through all the matching node types and attributes as they appear in the Graph Search query. Every asset and finding table shows different default columns. For more information, see Table view columns. You can view the full asset information of any cell in the table by clicking the cell.
You can export the Graph Search results as a PNG, SVG, or TSV file. You can always edit the query once the results are displayed, which means that the old results are discarded and the new results are displayed. In addition, you can save the results to the Query Library.
The Graph Search resulting graph displays the paths according to the nodes and conditional attributes that you selected in your query. Here are a few things to keep in mind when viewing the graph results:
There are two different types of nodes, where each node has its own unique shape, icon, and color:
Asset nodes: Each asset node is depicted as a circle in the resulting graph, where the color and icon displayed is dependent on the asset category and class types selected. There are multiple class types available for each asset node category selected. Once a class type is selected in the node picker dialog box and you hover over it, all the available asset types are listed according to the data collected. For more information, see All assets.
Finding nodes: Each finding node is depicted as a diamond in the resulting graph, where the color and icon displayed is dependent on the finding type selected. There is only one category type available for each finding selected.
In the resulting query, nodes are automatically grouped together to keep the graph looking cleaner and less busy. Nodes are grouped together when there are at least five nodes that meet the following conditions:
The node isn't a root node.
The path is identical.
For asset nodes, the nodes have the same class and category type.
For finding nodes, the nodes have the same category type.
A grouped node icon is displayed as a duplicate node. For example, if it's a group node, the icon looks like two shapes, one on top of another. When you select the group node, a dialog box opens displaying all the nodes included in the group.
When you select each node, or hover on it and select More Info, you'll see more information displayed in a dialog box. You can click View Details to drill down even further on the node to display more information on the node depending on the data collected for that asset or finding node selected.
Vulnerability finding nodes automatically display under the node the breakdown of severity.
Every Graph Search query returns a maximum of 50 paths with an indication displayed at the bottom of the page of the total number of results.
On the right side of the graph results, there are different icons that can help you drilldown into your graph results:
+ and - icons: Use the plus and minus icons to zoom in and out of the graph.
: Use the diamond icon to center your graph after you've manipulated the output.
: Use the layers icon to easily add or remove additional information to the graph without having to define these parameters in your Graph Search query. You can decide when to include these built-in layers, as needed. The following are available:Public Exposure to the Internet: Tracks the asset nodes with internet exposure that could be targeted for external surface attacks by displaying the exposure path. A Globe node called Internet is added to the graph, which links all exposed asset nodes to this Globe node. You can expand this connection by clicking the + icon to reveal the full internet path to include, for example, the NIC, Subnet, and Gateway. In the exposure path, you can select each node, or hover on it and select More Info, you'll see more information displayed in a dialog box. You can click View Details to drill down even further on the asset node to display more information on the node depending on the data collected for that asset node selected. Internet paths are collapsed by default.
Related Cases: Displays the number of related Cases for each asset node with a breakdown by severity.
Runtime Events: Adds 100 most recent runtime events to the graph results, which are refreshed every hour. This enables you to investigate real-time activity and identify critical events, such as access to sensitive information typically contained in a storage bucket, which generate issues and cases. All the bucket nodes in the path include a runtime icon
underneath and run an animation on all the bucket and virtual machine nodes. You can click the runtime icon to reveal more info, such as connection details and runtime events. Click Show Recent Events to display the Runtime Events table with more details on the last 100 events.
The results from the different layers are displayed in tabs in the node dialog box, which enables you to quickly switch from one layer to the other.
: Use the Group nodes icon to group by the Cloud Provider, Cloud Account, or Cloud Region. Selecting one of these grouping enables you to view the graph results in an aggregated format, providing a clearer and more organized perspective of the data. This feature also helps to Identify patterns and trends more easily in your data by grouping similar entities together. In the future, the Group nodes feature will be expanded to enable additional groupings.
This example focuses on using the layers icon to add or remove additional information to the graph and how to group information together using the Group node icon.