topic Workspace / Network Diagram expansion in Fraud, AML and Security Intelligence

Workspace / Network Diagram expansion

Idanar — Thu, 25 Jan 2024 13:45:37 GMT

Hi Experts,

In SAS Visual Investigator (10.8 HF 6) I would like that by default the network diagram will be expanded (without to "Right Click" --> "Expand links 1 Level")

Mostly I'm using Alert's workspace, and the diagram by default is unexpended. - There is a way to configure it?

I've search at documentation and still I didn't find a solution for this.

Thanks in advance,

Idan

Re: Workspace / Network Diagram expansion

_austin_ — Fri, 02 Feb 2024 15:22:15 GMT

Hi Idan,

I don't think there is a way to configure that, but I have two follow-up questions.

I assume you are talking about workspaces that were created during alert generation. Is that right?
If so, are the workspaces created according to the setting in the strategy or do the incoming alerting events include json that specifies exactly which entities should be in the workspace?
When you say the network diagram should be expanded, are you saying that the nodes that were placed in the workspace during the alert generation are not initially visible? Or are you saying that the nodes that were added to the workspace are visible, but you would like the diagram to automatically expand out one level beyond what was originally added to the workspace. (Could you attach a screenshot of what you are seeing?)

Thanks

Re: Workspace / Network Diagram expansion

Idanar — Tue, 06 Feb 2024 07:45:53 GMT

Hi Austin,

My Answers in red

I assume you are talking about workspaces that were created during alert generation. Is that right? Yes, after an alert generation, the workspace includes only the alert icon itself, and the icon of the actionable entity. The actionable entity can be expanded as there is a some relationship between different entities. I just want them to be expanded.
If so, are the workspaces created according to the setting in the strategy or do the incoming alerting events include json that specifies exactly which entities should be in the workspace? the workspace created according to the strategy, as there is no json included.
When you say the network diagram should be expanded, are you saying that the nodes that were placed in the workspace during the alert generation are not initially visible? Or are you saying that the nodes that were added to the workspace are visible, but you would like the diagram to automatically expand out one level beyond what was originally added to the workspace. (Could you attach a screenshot of what you are seeing?) No nodes were placed manually, I just want the diagram will expand as I'd open the alert / workspace tab. below a screenshot from Alert.

All I need is that the "9" indicator will be expand.

Thanks,

Idan

Re: Workspace / Network Diagram expansion

_austin_ — Wed, 07 Feb 2024 14:43:03 GMT

Hi Idan,

In your strategy settings (for the strategy the alert is created in) what is the number of levels that the workspace is supposed to traverse when it is generated? It is configurable, but it is often set to 0 because the search query that builds the workspace is run during alert generation and that can be time consuming if you are generating a lot of alerts at once.

If you change the visualization of the workspace from network to list, what is displayed? Does it just show the alert and the entity or does it show the alert, the entity and the 9 other related entities in the list?

Thanks,

Austin