Configuring the Graph Browser

This section describes the configuration options that are available for customizing the Graph Browser.

For the end user, the Graph Browser can be configured by using the sidebar on the right. The sidebar tabs allow the user to change the following settings:

Lenses tab: You can add lenses, change the selected lens, remove one or more lenses, and modify lens settings.
Expansion tab: You can select or deselect the dashboard filters and the simple or aggregated relations.
Selection tab: The selected graph items are shown in a grid. You can hide columns, sort rows in a different order, or sort them by type and so on.
Cards tab: You can apply special views on the currently-selected nodes.

When a configuration is modified, a Save button appears in the top right of the sidebar. If you do not save the changes, they will be lost when the session is closed.

For advanced users, further configuration settings are available in the Graph Browser app, by clicking Edit and the pencil icon, which opens the configuration screen.

After you have made the configuration updates, click Apply changes and Save.

The General tab

The following general configuration options are available:

Big nodes threshold

When the user expands a node, this threshold setting defines the number of nodes that cause the original node to be considered a 'big node'. If a node surpasses this threshold value, the user is given a choice either to proceed or to select a sample.

Graph layout tightness

You can specify a number between 0 → 10 that controls how close together the nodes are. A higher value makes the nodes appear closer together.

Graph minimum zoom

You can specify a number between 0 → 1 that controls how far away you can zoom from the nodes. A lower value lets you zoom out more.

Graph expansion limit

You can specify a number between 100 → 10000 that controls how many nodes will be imported into the graph when you are adding data from a dashboard.

Truncated labels length

If you want to adjust the length of node labels that are displayed in the graph, set the slider to a number between 10 → 100 to represent the number of visible characters.

Automatically recount on change of selected relations or filters

Select this checkbox to perform automatic recounts of data on nodes when the user changes the selected relations or filters.

Sidebar is open by default

Select this checkbox to ensure that the graph sidebar is expanded by default.

Right-to-left text rendering

Select this checkbox to correctly display text for languages that use right-to-left scripts, such as Arabic.

Use data model images

If a custom default image has been set in the Data model app, select this checkbox to use the same image for the nodes in the graph.

The Scripts tab

The Graph Browser supports a broad range of scripts.

To create new scripts or modify existing ones, go to Management → Scripts.

Script auto configuration

Quick start: To quickly get started, click Add all available lenses. This default configuration is suitable to start with in most use cases.

Contextual Functions

The Context Menu appears when you right-click anywhere on the Graph Browser canvas.

The following options are available:

View Full Record: Opens the record view, which provides options to view the record or its related data
Add/Edit Link: Opens a screen that allows you to add links or edit existing links between nodes.
Expand by relation: Opens a popup that enables you to choose one or more of the available relations and expands the selected elements using only the selected ones. This does not override the graph browser configuration. You will see only the configured relations (if available for the selected nodes).
Select:
- Select - All: Select all the elements (equivalent to Ctrl+A).
- Select - By Entity Type: Select nodes based on their type. You can specify the type through the popup that appears.
- Select - Extend: Extends the current selection to the sibling elements.
- Select - Invert: Inverts the current selection.
- Select - By Edge Count: Select nodes based on their link count. You can specify the count through the popup that appears.
Sort:
- By label: Sorts nodes alphabetically.
- By count: Sorts nodes by edge count.
Show nodes count by type: Shows a popup with information about how many nodes per type are currently displayed.
Shortest Path: Calculates the shortest path between two selected nodes by fetching the connected elements.
Common Communicators: Detects paths that minimize the distance between three or more input nodes at the same time. The resulting generated paths tend to reach toward a common subset of nodes that act as intermediaries between the input nodes.

Custom contextual scripts are deprecated and are replaced by Siren API scripts.

Lenses

Lenses alter the visual appearance of graph nodes and edges, and can be cascaded as well as switched on and off at will during an investigation.

In a dashboard, click Edit from the upper toolbar.
Click the pencil icon of the Graph Browser that you want to change.
In the Options menu, under Lenses, click Add Lens Script.
Select the script that you want to add and click Apply changes.
Click Save.

The following lens scripts are available:

Size lens: Set the size for all nodes using an expression.
Color lens: Define color for all nodes using a field.
Conditional lens: Set node properties using expressions.
Label lens: Set the label for all nodes using an expression.
Associate records based on ontology lens: Replaces a node with associated records based on ontology.
Time and location lens: Set time and location properties.

Cards

Cards are used to show additional data about the graph content.

In a dashboard, click Edit from the upper toolbar.
Click the pencil icon of the Graph Browser that you want to change.
In the Options menu, under Cards, click Add Card Script.
Select the script that you want to add and click Apply changes.
Click Save.

The Histogram script is available, which displays a histogram of data points that represent the currently-selected nodes.

You can also create custom card scripts to fit your graph needs.

There is an additional category of script that is used in the Graph Browser, called 'sampling'. Sampling controls how many records can be imported into a graph from a dashboard. For more information, see Sampling data in the graph.

The Performance tab

Entities with no count pre-computation

You can choose not to pre-compute link counts for selected entity types. This can improve the system performance in some use cases.

Fields to exclude

You can specify fields for each entity that you do not want to retrieve. It might be beneficial to system performance to exclude large fields that do not contribute to the link analysis. For example, you can exclude large textual blobs or technical metadata.

Multi-search expansion limit

You can specify the number of queries to include in multi-searches.

Advanced Graph Browser settings

There are additional settings that affect the graph behavior and performance, which can be found in on the Management → Advanced Settings screen.

You can see all of the available graph configurations by filtering for 'graph' in the search bar.

graph-browser:shortestPathLogLevel: Specifies the level of detail in the log when you run Shortest Path or Common Communicator scripts.
siren:graphStatesLimit: Specifies the number of undo and redo steps to retain in memory.
siren:graphMaxConcurrentCalls: Specifies the number of concurrent calls that can be made by the Graph Browser.

Graph Browser configuration settings

The Graph Browser configuration is saved as part of the object configuration in the uiStateJSON component of the graph browser visualization. You can access the component by clicking Management → Saved objects→ Visualizations→ Graph Browser.

The structure of the saved JSON enables different configurations for the Graph Browser in different dashboards. All of the configurations are stored under an id related to the dashboard id.