Graph concepts
The graph is built around entities, edges, and the intelligence attached to each connection. It surfaces what is connected, how strong the evidence is, and whether the relationship is observed or inferred.
Node types
Nodes can represent domains, IP addresses, URLs, ASN blocks, certificates, organizations, emails, hashes, campaigns, and malware families.
Edge types
FACT edges represent directly observed infrastructure relationships.
INTEL edges represent enrichment-backed connections from providers or internal analysis.
AI-INFERRED edges represent model-assisted hypotheses that help analysts explore likely links faster.
Confidence scoring
Confidence is influenced by:
- source reliability
- number of corroborating indicators
- path depth
- temporal proximity
- model certainty
The graph is more valuable when it explains why two nodes are connected rather than only showing the connection itself.
Intelligence layers
- Raw observations
- Provider enrichment
- AI reasoning
- Relationship synthesis
- Analyst review
