Network Graph & Evidence Log¶
Audience: All client users (with access to the assessment) · Where: the Network Graph and Evidence and Actions Log tabs inside an assessment. These tabs are for network engagements (Internal / External); a web-app or ASM assessment won't show the Network Graph.
Both tabs answer the question "how was this actually tested, and how do the pieces connect?" — one visually, one as an audit trail.
Network Graph¶
An interactive map of your environment as the testers saw it: hosts, services, vulnerabilities, credentials, and how one weakness leads to the next. The tab has two views, switched from the toggle in the top-left corner:
-
Attack Path (default)
A branching attacker → host → finding map that shows what was reached and how.
-
Topology
The network laid out as a device map, with the discovered attack chains listed alongside it.
Shared across both views
A search box (host, IP, CVE, or user) and severity chips (Critical / High / Medium / Low / Info) to focus the picture.
This is the "so what?" view — it reads left-to-right from a single origin (the attacker starting point), out to each host that was in play, and then to the findings on that host. Where the testers pivoted from one machine to another using recovered credentials, a link joins the two hosts.
- Hosts list (left) — names every host in the graph, each with a severity dot, its finding count, and a compromised marker where access was gained. Click a host to center the map on it.
- Drill into a timeline — click a host (or one of its findings) that has a completed exploitation chain to open the ordered kill-chain of steps taken against that host. Use Back to hosts to return.
- Toolbar controls — Show failed reveals steps that were attempted but didn't succeed; Time axis lays the steps out in the order they happened; a counter shows how many attack paths exist.
- Step detail panel — in a timeline, click a step to open it: the technique/tool used, the MITRE tactic and phase, the target, any credential used, the access level gained, timing, a failure reason (for attempted steps), a link to the related Finding, and the captured evidence.
Use this view to understand impact and blast radius — not just that a host is vulnerable, but what an attacker could reach from it, and in what order.
A device-centric map of the network: discovered devices grouped by subnet, joined to a gateway/firewall spine, so you can see the shape of the environment rather than a chain.
- Attack chains sidebar (left) — lists the discovered multi-step chains, each with its name, a severity dot, and its number of steps. Click one to highlight and number that path on the map.
- Filter by Types — Hosts, Services, Credentials, Vulnerabilities, CVEs, Exploit attempts, and — for internal AD engagements — AD users / groups / computers / domains, plus recon enrichment.
- Filter by Phase — ATT&CK-style: Reconnaissance, Initial access, Lateral movement, Privilege escalation, Impact.
- Detail toggles — Simple vs Detailed (Detailed adds edge labels). Show attempted reveals exploit attempts that failed — it carries a count badge, and is disabled with an explanation when the scan recorded none. Show unlinked brings back nodes that have no connections (hidden by default to reduce clutter).
- Layout & export — Re-layout re-arranges the map from scratch; the camera button exports the current view as a PNG. A counter shows the graph size (e.g. "258 nodes", marked (clustered) when similar nodes have been grouped).
- Node detail drawer — click any node to open a summary, a deep-link to its Finding, its connections to other nodes, an expandable View evidence panel with the raw tool output, and — for AD nodes — its role (e.g. Domain Controller, Domain Admin) and status badges (owned, credential exposed, valid credential).
Evidence and Actions Log¶
A complete, time-ordered record of every tool the engagement invoked — the transparency trail behind the findings. It's ideal for audits, for reproducing a result, or for confirming exactly what was (and wasn't) touched.
Each row has these columns:
| Column | What it shows |
|---|---|
| When | The timestamp of the invocation. |
| Action | e.g. Scanned, Executed. |
| Tool | nmap_scan, nikto, whatweb, enum4linux, netexec, ldapsearch, … |
| Target | What the tool ran against. |
| Result | The outcome of the invocation. |
| Severity | An outcome level of info, success, warning, or error (rows are tinted to match). |
Expand a row to see the captured tool output along with the job it belonged to and the output length.
Output is capped at ~8 KiB
The platform stores up to ~8 KiB per invocation, and the row tells you when a longer transcript was head-truncated.
Narrow the log with the free-text Search box (it matches across tool, action, target, and result) or the Severity dropdown, sort by When, Action, or Tool, and page through the entries (engagements commonly log hundreds).
Tips¶
Tip
- The graph is best for communicating risk to others; the log is best for verifying and auditing a specific result.
- Cross-reference the two: find a finding's tool in the Evidence Log to see its raw output, then locate the affected host in the Network Graph to see what it exposes.
- If the Attack Path view is empty, the engagement hasn't produced findings or a completed chain yet — switch to Topology to explore the discovered assets in the meantime.
- The live version of this activity (while a scan runs) is on the assessment's Overview tab.
Related: Assessment Overview · Findings · Reports