Graphical flow diagram with a process tree that you can build according to your investigation needs, from left to right and top to bottom. The tree is also interactive, which means you can click on a specific component to drill down for more details or contextual actions.

Node—Source of an activity or event, which can be a process, an endpoint, a thread or service, or another security product. Nodes are represented by boxes with icons for the activity type, some with descriptions under the boxes.

• Click on a node to display the Details pane on the right and the Activity events tables on the bottom with contextual information about that specific node.

• Click the Collapse () or Expand () icon in the right of a node icon to show or hide all the downstream nodes, edges, and leaves.

• Right-click a node to perform actions allowed on the node, including any custom actions you defined. These action buttons also appear in the Details Pane, which is available on the right after you click the node.

  The list of available options varies by node type. The following is an example list of actions for a process node.

  

Edge—Activity event type or action represented by a curved line with an arrow. An edge can be one activity event/action or an aggregation of several. The numbered arrows indicate the sequence of actions and specify the action that was performed, such as Process Creation, Socket Close, Block and so on. Multiple operations performed between two processes are represented by multiple arrows between them. Edges that triggered the event are indicated in red.

Click on an edge to display the Details pane on the right and the Stacks view on the bottom with contextual information about that specific edge.

Edges may also have icons below them indicating classification or violation of certain rules and MITRE & Behavior models. Click on an icon for more detailed information.

Leaf—Target of activity event of type File, Registry Key, Registry Value, Network components (IP/DNS/URL). A leaf can also be a group of artifacts. For example, all the files created or modified by a process. Leaves have a round shape ().

• Click on a leaf to display the Details pane on the right and the Activity events tables on the bottom with contextual information about that specific leaf.

• Right-click a leaf to perform actions allowed on the leaf, including any custom actions you defined. These action buttons are also available in the Details Pane, which appear on the right after you click the leaf.

  The list of available options varies by leaf type. The following is an example list of actions for a network leaf:

  

Hint—Categorized groups of activities related to a node that are not part of the main chain of activity events and thus not represented in the graphical diagram. Click a node to show the number of relevant activities. The hints no longer display after you move the selection to another node or edge.

• Click the Expand () or Collapse () icon near a leaf hint to show or hide the node or leaf list of that type.

• Right-click the type name of a hint and select Add to graph to add the relevant leaves to the graph or select View activity event to pull out the Activity events tables for this specific file type. The Add to graph option is unavailable when the number of hints exceeds 500, in which case you can only choose to view the activity event.

  

Use the Rules or MITRE & Behavior legends to highlight the corresponding icons below relevant edges in the diagram.

• Use the Zoom In (), Zoom Out (), and Zoom To Fit () buttons to adjust the graph window size.

• Use the Reset () button to restore the graph to the default view.

• Use the Undo () button to cancel an operation.