Configuring the Graph Browser

Advanced users can adjust the performance and general functions of the graph browser and write scripts to configure visualization features such as lenses and cards.

To configure lens, cards, relation and selection tools for the graph browser. See Controlling graph data visualization

Configuring advanced settings

To access the advanced configurations for the graph browser:

  1. Open the graph browser.

  2. From the Options menu, click Edit.

  3. In the upper-right corner of the graph browser, click the edit button (pencil icon). The configuration settings open on the left of the graph browser pane.

  4. After you have made the configuration updates, click Apply changes and Save.

General settings

Big nodes threshold

When the user expands a node, this threshold setting defines the number of nodes that cause the original node to be considered a 'big node'. If a node surpasses this threshold value, the user is given a choice either to proceed or to select a sample.

Graph layout tightness

Specify a number between 0 → 10 to control how close together the nodes are. A higher value makes the nodes appear closer together.

Graph minimum zoom

Specify a number between 0 → 1 to control how far you can zoom out from the nodes. A lower value lets you zoom out more.

Graph expansion limit

Specify a number between 100 → 10000 to control the amount of nodes imported into the graph when you add data from a dashboard.

Truncated labels length

Set the number of visible characters for node labels.

Automatically recount on change of selected relations or filters

Select this checkbox to perform automatic recounts of data on nodes when the user changes the selected relations or filters.

Sidebar is open by default

Select this checkbox to ensure that the graph sidebar is open by default.

Right-to-left text rendering

Select this checkbox to correctly display text for languages that use right-to-left scripts, such as Arabic.

Use data model images

If a custom default image is set in the Data model app, select this checkbox to use the same image for the nodes in the graph.

Scripts

The graph browser supports a broad range of scripts.

To create new scripts or modify existing ones, go to Management → Scripts.

Script auto configuration

Quick start: Click Add all available lenses. This default configuration is suitable to start with in most use cases.
Contextual functions

The Context Menu appears when you right-click anywhere on the Graph Browser canvas.

The following options are available:

  • View Full Record: Opens the record view, which provides options to view the record or its related data

  • Add/Edit Link: Opens a screen that allows you to add links or edit existing links between nodes.

  • Expand by relation: Opens a popup that enables you to choose one or more of the available relations and expands the selected elements using only the selected ones. This does not override the graph browser configuration. You will see only the configured relations (if available for the selected nodes).

  • Select:

    • Select - All: Select all the elements (equivalent to Ctrl+A).

    • Select - By Entity Type: Select nodes based on their type. You can specify the type through the popup that appears.

    • Select - Extend: Extends the current selection to the sibling elements.

    • Select - Invert: Inverts the current selection.

    • Select - By Edge Count: Select nodes based on their link count. You can specify the count through the popup that appears.

  • Sort:

    • By label: Sorts nodes alphabetically.

    • By count: Sorts nodes by edge count.

  • Show nodes count by type: Shows a popup with information about how many nodes per type are currently displayed.

  • Shortest Path: Calculates the shortest path between two selected nodes by fetching the connected elements.

  • Common Communicators: Detects paths that minimize the distance between three or more input nodes at the same time. The resulting generated paths tend to reach toward a common subset of nodes that act as intermediaries between the input nodes.

Custom contextual scripts are deprecated and are replaced by Siren API scripts.

Lens scripts

Lenses alter the visual appearance of graph nodes and edges, and can be cascaded as well as switched on and off during an investigation. The following lens scripts are available:

  • Size lens: Set the size for all nodes using an expression.

  • Color lens: Define color for all nodes using a field.

  • Conditional lens: Set node properties using expressions.

  • Label lens: Set the label for all nodes using an expression.

  • Associate records based on ontology lens: Replaces a node with associated records based on ontology.

  • Time and location lens: Set time and location properties.

To add a lens script:

  1. In the Configuration pane, go to the Scripts tab.

  2. Under Lenses, click Add Lens Script.

  3. Select the script and click Apply changes.

  4. Click Save.

    Cards

    Cards are used to show additional data about the graph content. The Histogram script displays a histogram of data points that represent the currently-selected nodes.

You can also create custom card scripts to fit your graph needs as follows:

  1. In the Configuration pane, go to the Scripts tab.

  2. Under Cards, click Add Card Script.

  3. Select the script and click Apply changes.

  4. Click Save.

There is an additional category of script that is used in the Graph Browser, called 'sampling'. Sampling controls how many records can be imported into a graph from a dashboard. For more information, see Sampling data in the graph.

Performance settings

Entities with no count pre-computation

You can choose not to pre-compute link counts for selected entity types. This can improve the system performance in some use cases.

Fields to exclude

Specify fields for each entity that you do not want to retrieve. It might be beneficial to system performance to exclude large fields that do not contribute to the link analysis. For example, you can exclude large textual blobs or technical metadata.

Multi-search expansion limit

Specify the number of queries to include in multi-searches.

Additional advanced Graph Browser settings

There are additional settings that affect the graph behavior and performance, which can be found in on the Management → Advanced Settings screen.

See all of the available graph configurations by filtering for 'graph' in the search bar.

  • graph-browser:shortestPathLogLevel: Specifies the level of detail in the log when you run Shortest Path or Common Communicator scripts.

  • siren:graphStatesLimit: Specifies the number of undo and redo steps to retain in memory.

Object configuration

The Graph Browser configuration is saved as part of the object configuration in the uiStateJSON component of the graph browser visualization. To access the component, go to Management → Saved objects→ Visualizations→ Graph Browser.

The structure of the saved JSON enables different configurations for the Graph Browser in different dashboards. All of the configurations are stored under an ID related to the dashboard ID.