Relations Graph

An asset represents the device, identity, or resource that a threat has targeted and is identified by one or more observables. Assets are connected by lines to other related nodes in the graph.

When assets and observables (or other assets) have the same strong identifier, they are unified into one asset node to simplify the view. Asset unification occurs:

• With any one asset in the graph irrespective of the type or module where it originated. If there are other assets that match the observable, they will be ignored.
• If the observable is found in the asset’s list of observables.
• When asset nodes are from the same module based on their strong identifiers (observables) which don’t change over time, such as AMP GUID or ODNS identity.
• When assets from different modules have IP addresses within an overlapping time range.

A dashed line between assets on the graph indicates that it’s a weak relationship. A label at midpoint shows how the assets are connected (for example, Connected by IP Address). When you hover over the line, a tool tip provides details about the weak relationship.

During an investigation, an attempt is made to resolve the assets that were identified in the investigation to assets in the Inventory table in Cisco XDR Devices:

• If there is a match to a single device, the node in the graph is replaced with an icon representing the asset, and all relationships of the that node become the asset relationships. The name of the asset node is the Device Name in the Inventory table.

• If there are multiple matches to devices, the nodes and their relationships in the graph are preserved, and the nodes are linked to the new asset nodes.

You can view asset details in the Node drawer. Click View in devices to open the Inventory table.

When nodes are grouped, the edge is a dotted circle, with a badge that indicates the number of nodes in the group.

In this example, these nodes were grouped because they are of the same observable type and have the same relationship (connected to) another observable.

Click the (Ungroup) icon to ungroup the nodes and return to the original view.

Double-click the grouped node to expand it and view all the nodes contained in the group. Click any node in the group to open the Node drawer and view more information.

To add observables to your investigation, perform the following steps:

1. Click an observable node in the Relations Graph panel that was not part of the original investigation to open the Node drawer.

Note: Observables that were investigated show the (Investigated) icon next to it in the graph.

2. In the Node drawer, click Add observable to investigation.

   Alternatively, click the Pivot menu next to any observable in the Assets and Observables panel that has not been investigated, and then click Add observable to investigation.

   If the investigation is a saved investigation, a confirmation message is displayed.

3. Click Continue to add the observable to the investigation.

   The original investigation is cloned and opens in a new tab. The investigation runs with the newly added observable and displays the results.

   You can continue adding observables to the investigation until the cloned investigation is saved.

4. Once you are done adding observables to the cloned investigation, click Save.

5. On the Save Investigation dialog box, enter a Title and Description for the new investigation and click Save.

Note: If you do not save the investigation before closing the tab, the investigation will be lost.

You can also remove observables from an investigation and save the investigation with the new results.

To remove an observable from the current investigation, perform the following steps:

1. Click the observable node in the Relations Graph panel that you want to remove from the investigation to open the Node drawer.

Note: Observables that were investigated show the (Investigated) icon next to it in the graph.

2. In the Node drawer, click Remove observable from investigation.

   Alternatively, click the Pivot menu next to any observable in the Assets and Observables panel that was investigated, and then click Remove observable from investigation.

   If the investigation is a saved investigation, a confirmation message is displayed.

3. Click Continue to remove the observable from the investigation.

   The original investigation is cloned and opens in a new tab. The investigation runs with the newly removed observable and displays the results.

   You can continue removing observables to the investigation until the cloned investigation is saved.

4. Once you are done removing observables from the cloned investigation, click Save.

5. On the Save Investigation dialog box, enter a Title and Description for the new investigation and click Save.

Note: If you do not save the investigation before closing the tab, the investigation will be lost.