Visualization techniques can help an analyst make sense of a given data set by exposing scale, relationships, and features that would be almost impossible to derive by just looking at a list of individual data points. As of RSA NetWitness Platform 11.4, we have added new physics and layout techniques to the nodal diagram in Respond in order to make better sense of the data both for when using Respond as an Incident/Case Management tool or when simply using Respond to group events and track non-case investigations (see https://community.rsa.com/community/products/netwitness/staging/pm-ux/blog/2020/01/30/using-respond-for-data-exploration for some ideas).
Clustering by Entity Type
Prior to 11.4, the nodal graph evenly distributed the nodes regardless of entity type (Host, IP, User, MAC, File). Improvements were made to introduce intelligent clustering such that entities of the same type not only retain their distinct color, but also have a higher chance of being clustered together. This layout improvement makes it clearer to see relationships between different entity types, particularly when dealing with larger sets of data.
Variable Edge Forces Based on Relationship Type
Prior to 11.4, all edges between nodes were treated equally, resulting in lengths being rendered equally between all sets of connected nodes. Improvements were made to adjust the relative attraction forces, helping to better distinguish attribute type relationships ("as", "is named", "belongs to", and "has file") from action type relationships ("calls", "communicates with", "uses"). Edges representing attributes will tend to be much shorter than those representing actions, which has the added benefit of reducing the number of overlapping edges, making relationships, scope, and sprawl much easier for an analyst to see at a glance.
Separation of Disconnected Clusters
Prior to 11.4, all nodes and edges were grouped into one large cluster, even if certain nodes in the data set did not have any relationship with others, requiring tedious manual dragging of nodes in order to distinguish the groupings. Now, disjoint clusters of nodes are repelled from one another upon initial layout, making it extremely clear which sets of data are joined by some kind of relationship. This is particularly helpful when using Respond for general data exploration of larger data sets (vs visualizing a single incident) that do not necessarily have commonality, both drawing the analysts eyes to potentially interesting outliers and once again reducing the number of overlapping edges that have historically made certain nodal graphs difficult to read, depending on the data set.
Improved Nodal Interaction
In addition to the physics governing new layouts, improvements have been made to nodal interaction to help take advantage of them. Given the potential size and complexity of data sets, despite the introduction of layout and force techniques, the layout may not always be optimal. The goal was to improve interaction by minimizing the number of graph drags needed by an analyst to make sense of even the most tangled data sets. When dragged, nodes with high connectivity will generally attract other nodes with which a relationship exists. Also, once any node is manually dragged into position, manipulating the position of other nodes will no longer impart a moving force, meaning the original dragged node will stay in place. To "unpin" dragged nodes and have them spring back into place, simply double click.
As always, if you have any feedback or suggestions on how to make this experience even better, please leave a comment or, better yet, search, submit, and vote on product enhancements on the RSA Ideas portal: RSA Ideas for the RSA NetWitness Platform
Happy Hunting!
3 Comments
