Workspace / Network Diagram expansion

[Idanar]

Hi Experts,

In SAS Visual Investigator (10.8 HF 6) I would like that by default the network diagram will be expanded (without to "Right Click" --> "Expand links 1 Level")

Mostly I'm using Alert's workspace, and the diagram by default is unexpended. - There is a way to configure it?

I've search at documentation and still I didn't find a solution for this. 

Thanks in advance,

Idan

[_austin_]

Hi Idan,

I don't think there is a way to configure that, but I have two follow-up questions.

• I assume you are talking about workspaces that were created during alert generation. Is that right? 
• If so, are the workspaces created according to the setting in the strategy or do the incoming alerting events include json that specifies exactly which entities should be in the workspace?
• When you say the network diagram should be expanded, are you saying that the nodes that were placed in the workspace during the alert generation are not initially visible? Or are you saying that the nodes that were added to the workspace are visible, but you would like the diagram to automatically expand out one level beyond what was originally added to the workspace. (Could you attach a screenshot of what you are seeing?)

Thanks

[Idanar]

Hi Austin,

My Answers in red

• I assume you are talking about workspaces that were created during alert generation. Is that right? Yes, after an alert generation, the workspace includes only the alert icon itself, and the icon of the actionable entity. The actionable entity can be expanded as there is a some relationship between different entities. I just want them to be expanded.
• If so, are the workspaces created according to the setting in the strategy or do the incoming alerting events include json that specifies exactly which entities should be in the workspace? the workspace created according to the strategy, as there is no json included.
• When you say the network diagram should be expanded, are you saying that the nodes that were placed in the workspace during the alert generation are not initially visible? Or are you saying that the nodes that were added to the workspace are visible, but you would like the diagram to automatically expand out one level beyond what was originally added to the workspace. (Could you attach a screenshot of what you are seeing?) No nodes were placed manually, I just want the diagram will expand as I'd open the alert / workspace tab. below a screenshot from Alert.

All I need is that the "9" indicator will be expand. 

Thanks,

Idan

[_austin_ · Accepted solution]

Hi Idan,

In your strategy settings (for the strategy the alert is created in) what is the number of levels that the workspace is supposed to traverse when it is generated? It is configurable, but it is often set to 0 because the search query that builds the workspace is run during alert generation and that can be time consuming if you are generating a lot of alerts at once.

If you change the visualization of the workspace from network to list, what is displayed? Does it just show the alert and the entity or does it show the alert, the entity and the 9 other related entities in the list?

Thanks,

Austin