Visualize the entity attack surface

The entity attack surface explorer provides a complete view of an entity and its attributions and exposures. You can perform this exploration over a specific time range or for the current time.

You can display attributions such as associated MAC addresses, users, and IP addresses, along with exposures, such as entity posture metric gaps and triggered entity profile rules. For example, visualize which user entities are associated with which assets, or identify the security control gaps associated with an asset entity. The line thickness is a visual indicator of discovery activity, highlighting entities with the most attributions and helping you identify patterns and potential areas of concern.

Follow these steps to analyze an entity using the entity attack surface explorer:

  1. Select Analytics, then Exposure analytics, then Entity analysis.

  2. Search for the entity you want to analyze.

  3. Select the Attack surface tab.

  4. Select whether to view Historical (over time) or Current.

  5. (Conditional) If you selected Historical, then select a time range. This option is not available if you selected Current.

  6. Select the attributions to view on the entity attack surface explorer.

  7. Enter a number for Max nodes per attribution. Setting a maximum reduces noise and helps you focus on particular attributions.

  8. (Optional) Select the Link weights checkbox to visualize the weight of detection activity. When you turn on link weights, the line, or link, between an entity and its attributions appears thicker when there is more activity.

  9. Select Apply to display the results in the visualization.

After the visualization loads, you can drag the nodes around the screen, as needed. Double-click on an entity node (IP, MAC, Asset or User) in the attack surface explorer to reload the visualization and explore the entity you have selected. Alternatively, you can right-click the entity and then select Explore or Analyze, which will open a separate tab. Right-clicking on an entity profile rule, will allow for drill down to the entity profile rule details. Right-clicking on an entity posture metric gap, will allow for drill down to the entity posture metric.