Filtering the Visualizer

Use the filters at the top of the visualizer to change the content displayed in the canvas. Some filter options are static, others are dynamic based on the criteria selected elsewhere. When you modify the filter, the graph will be redrawn per the selected options.

The Visualizer can retrieve up to 10,000 detections from the API regardless of the filter criteria.

Nodes

Use the Nodes filter to select the types of nodes to display. There are three types of nodes:

• Indicators
• Impacted Devices
• Detection Rules

When the Indicators option is selected, groups of indicators and impacted devices related to the same rule may be clustered together on the graph. While any combination can be selected, omitting Detection Rules will usually result in a disjointed graph.

Rule Name

Use the Rule Name filter to hide or display rules. The rules displayed will depend on the other criteria selected in the report. Only the rules that are relevant to the rest of the criteria (such as Date Range, Device/Detections/Rule Status, Severity) can be selected.

Date Range

Use the date-range selector to specify the date range to display.

Filter by Status

You can refine the results in the Visualizer by Detection Status, Device Status, or Rule Status. Changing the status filters will initiate a new query to the Detections API and refresh the graph. All other filter changes will filter the existing data and redraw the graph.