Use Graphs to View Connection Data
You can view connection data by using various chart options. By default, you can view data by using records matched over time and connection graph.
The Records Matched Over Time graph displays the number of connections based on time.
The Connection Graph provides a visual representation of the connection retrieved.
Graph options available for grouped connections are table, bar, and pie.
If you use an Adblock Plus browser extension with a Mozilla Firefox web browser, the charts might not display properly. For the charts to display, you must remove the Adblock Plus browser extension. For more information about removing add-ons, see your web browser documentation.
Using the Time Series Graph
Time series charts are graphical representations of your connections over time; peaks and valleys that display, depict high and low connection activity.
If you previously saved a search to be the default, the results for that saved search display on the Connections page. If that search included Group By options selected in the Advanced View Definitions box, the Time Series chart is not available. You must clear the search criteria before continuing.
Time series charts are useful for short-term and long-term trending of data. Using time series charts, you can access, navigate, and investigate connections from various views and perspectives.
The following table provides functions you can use to view time series charts.
If you want to |
Then |
|---|---|
View connections in greater detail |
Magnifying the data in a time series chart allows you to investigate smaller time segments of the connections. You can magnify the time series chart using one of the following options: Press the Shift key and click on the chart at the time you want to investigate. Press the Ctrl and Shift keys while you click and drag the mouse pointer over the range of time you want to view. Move your mouse pointer over the chart and press the Up arrow on your keyboard. Move your mouse pointer over the chart and then use your mouse wheel to zoom in (roll the mouse wheel up). After you magnify a time series chart, the chart refreshes to display a smaller time segment. |
View a larger time span of connections |
Including additional time ranges in the time series chart allows you to investigate larger time segments or return to the maximum time range. You can view a time range using one of the following options: Click Max at the top left corner of the chart or press the Home key to return to the maximum time range. Move your mouse pointer over the chart and press the down arrow on your keyboard. Move your mouse pointer over the plot chart and then use your mouse wheel to zoom out (roll the mouse wheel down). |
Scan the chart |
To view the chart to determine information at each data point: Click and drag the chart to scan the time line. Press the Page Up key to move the time line a full page to the left. Press the left arrow key to move the time line one half page to the left. Press the Page Down key to move the time line a full page to the right. Press the right arrow key to move the time line one half page to the right |
Procedure
Click the Risks tab.
On the navigation menu, click Connections.
In the charts pane, click the Configure icon.
Using the Chart Type drop-down list, select Time Series.
Using the interactive time series charts, you can navigate through a time line to investigate connections.
To refresh the information in the graph, click Update Details.
Use Connection Graph to View Network Connections
The connection graph provides a visual representation of the connections in your network.
The graph that is displayed in the Connections window is not interactive. If you click the graph, the Radial Data Viewer window is displayed. The Radial Data Viewer window allows you to manipulate the graph, as required.
By default, the graph displays your network connections as follows:
Only allowed connections are displayed.
All local IP addresses are collapsed to show only leaf networks.
All country nodes are collapsed to a node named Remote Countries.
All remote network nodes are collapsed to one node named Remote Networks.
Preview thumbnail view of the graph displays a portion of the main graph. This is useful for large graphs.
The Radial Data Viewer includes several menu options, including:
Menu Option |
Description |
|---|---|
Connection Type |
By default, the radial graph displays accepted connections. If you want to view denied connections, select Deny from the Connection Type drop-down list. |
Undo |
Collapses the last node expansion. If you want to undo multiple expansions, click the Undo button for each expansion. |
Download |
Click Download to save the current topology as a JPEG image file or a Visio drawing file (VDX). To download and save the current topology as a Visio drawing file (VDX), the minimum software version you require is Microsoft Visio Standard 2010. |
The following table provides additional functions to view connections including:
If you want to |
Then |
|---|---|
Zoom in or zoom out |
Use the slider on the top-right side of the graph to change the scale. |
Distribute nodes on the graph to view additional details |
Drag the node to the preferred location to distribute nodes on the graph. |
Expand a network node |
Double-click the node to expand and view assets for that node. The node expands to include the specific assets to which that node was communicating. By default, this expansion is limited to the first 100 assets of the network. |
View additional details regarding a connection |
Point your mouse over the connection line to view additional details. If the connection is between a network node to a remote network or remote country, right-click to display the following Source and View Flows menus: If the connection is between two IP addresses, the source, destination, and port information is displayed when you click the connection line. |
Determine the amount of data involved in the connection |
The thickness of the line in the graph indicates the amount of data involved in the connection. A thicker line indicates a greater amount of data. This information is based on the amount of bytes involved in the communication |
Highlight a connection path |
Point your mouse over the connection line. If the connection is allowed, the path highlights green. If the connection is denied, the path highlights red. |
Determine the connection path for a particular node |
Pointer your mouse over the node. If the node is allowed, the path to the node and the node highlight in green. If the node is denied, the path to the node and the node highlights in red. |
Change graph view |
Using the preview thumbnail, move the thumbnail to the portion of the graph you want to display. |
Using Pie, Bar, and Table Charts
You can view connections data using a pie, bar, or table chart.
The pie, bar, and table chart options only display if the search includes Group By options selected in the Advanced View Definition options.
Click the Risks tab.
On the navigation menu, click Connections.
Note:The default saved search results display.
Perform a search.
In the charts pane, click the Configuration icon.
Configure the parameters:
Option
Description
Value to Graph
Using the Value to Graph list, select the object type to which you want to graph on the chart. Options include all normalized and custom flow parameters included in your search parameters.
Chart Type
Using the Chart Type list, select the chart type you want to view. Options include:
Table—Displays data in a table.
Bar—Displays data in a bar chart.
Pie—Displays data in a pie chart.
Click Save.
The data does not refresh automatically, unless your search criteria is displayed to automatically display details.
To refresh the data, click Update Details.