Graph Explorer
Investigate the two-hop network around a stored assessment.
Overview
Graph Explorer shows the assessment-time connections between the evaluated customer, shared indicators, enrichment nodes, and nearby customers. Assessment mode uses the stored snapshot so later graph changes do not rewrite the original evidence.
Accessing the Graph Explorer
Open Dashboard → Graph Explorer and select an assessment from the rail, or use:
/dashboard/graph-explorer?assessmentId=<uuid>Your plan must include graph_explorer and your account needs access to the assessment.
Investigation workflow
- Select an assessment and read its score, action, and strongest ranked path.
- Search for an entity or select a node to highlight its path.
- Switch between Evidence flow and Rings when the topology is easier to compare concentrically.
- Filter by severity, entity type, unknown evidence, or risk-only mode.
- Pin relevant paths, rings, and entities to the case tray; add notes or copy the set as Markdown.
- Open the linked Event Explorer history before resolving the case.
The case tray is scoped to the selected assessment and stored in browser memory only. It is not transmitted or shared with teammates.
Node types
| Node | Meaning | | --- | --- | | Transaction | The assessment that anchors the evidence flow. | | Assessed customer | The customer evaluated by the assessment. | | Connected customer | A nearby account sharing evidence. | | Identity/device/network | Hashed or masked shared indicators. | | Payment | Payment fingerprints and card evidence. | | Location | Country or location context. |
Entity colour identifies type; the outer ring identifies risk. Amber means medium and red means high or critical.
Risk-user properties can include user_id, is_confirmed_fraud, knn_fraud_similarity, gds_pagerank_score, and gds_betweenness_score. Indicator properties include indicator_type, indicator_hash, and is_global_threat.
Email, phone, and IP values are masked in graph responses. Indicator hashes remain visible. In assessment mode, peer is_confirmed_fraud labels are suppressed so outcomes learned later are not presented as assessment-time knowledge.
Edge types
| Edge | Connection |
| --- | --- |
| USES_INDICATOR | Customer to device, IP, email, phone, or payment indicator. |
| USED_CARD_BIN | Customer to card BIN. |
| LOCATED_IN | Customer to assessment-time IP geography. |
The highlighted route is the decision path. A +N badge means a bounded branch can be expanded. Indicators with more than 500 connections are excluded as super-connectors that add little usable signal.
Canvas controls
- Find an entity centres a visible result without removing its context.
- Evidence flow and Rings change layout only.
- Filters, zoom, and fit narrow or restore the view.
- The timeline fades evidence outside the selected date without reflowing the graph; undated evidence remains visible.
| Key | Action |
| --- | --- |
| / | Focus search. |
| F | Fit graph. |
| [ / ] | Step through visible entities. |
| ? | Show shortcuts. |
| Esc | Clear focus, search, and filters. |
Investigation inspector
- Assessment: score, decision, reason codes, ranked paths, rings, and topology.
- Entity: selected-node evidence, relationships, safe properties, and graph metrics.
- Case: pinned evidence and analyst notes.
KNN similarity compares a user with nearby confirmed-fraud embeddings; PageRank indicates network centrality; betweenness identifies bridge accounts. Treat these as supporting evidence rather than independent verdicts.
API endpoint
GET /graph/explore/:assessmentId returns tenant-scoped nodes, links, and meta using bearer authentication. Each link contains source, target, and type; metadata includes the seed user and node/link counts.
Assessment mode vs live mode
- Assessment mode: anchored to a stored assessment snapshot.
- Live mode: shows the customer neighbourhood currently stored in the graph.
Use assessment mode for decision review and live mode for current-network investigation.