Visualization Panel¶

The Visualization panel provides a graph-based view of connections between domains in your Pivot Engine results. It depicts domains and their attributes as nodes, with lines showing relationships, making it easy to identify patterns and clusters.

What's included¶

The Visualization panel displays:

Domain nodes: Blue dots representing domains
Attribute nodes: Color-coded nodes for different data types
Connection lines: Edges showing relationships
Legend: Color coding and node count for each field
Interactive controls: Zoom, drag, and filter options

Visual indicators¶

Node types¶

Domains : Blue nodes representing domains in your results : Larger dots indicate high-risk domains (risk score 70+) : Normal-sized dots for other domains

Attributes : Color-coded nodes for different field types : Each field type has a distinct color : Size may vary based on connection count

Legend¶

The legend in the upper left shows:

Color coding for each field type
Count of instances for each field
Which fields are currently displayed

Configure visualization¶

Select fields¶

Choose which fields to visualize:

Select Edit Fields in the panel.
Choose up to 4 fields (plus domain) to view.
Select Apply.

Common field combinations:

Email, IP, Name Server, Registrar
IP, ASN, Country, Name Server
Email, Registrant, Registrar, Tags

Layout options¶

The visualization uses a Force layout that:

Positions related nodes closer together
Spreads unrelated nodes apart
Updates dynamically as you interact

Link degree filter¶

Use the Link Degree slider in the lower-right to filter nodes:

Higher values: Show only highly connected nodes
Lower values: Include nodes with fewer connections
Adjust to focus on the most interesting connections

Interact with visualization¶

Navigate the graph¶

Zoom : Use mouse wheel or pinch gesture : Zoom in to see details : Zoom out for overview

Pan : Click and drag background : Move to different areas of the graph

Drag nodes : Click and drag any node : Reposition for better view : Especially useful in Force layout

Inspect nodes¶

Hover : Hover over a node to highlight it : Connected nodes also highlight : See immediate relationships

Double-click : Double-click a domain or IP node : Makes it the current domain : Populates all domain-centric panels

Node Inspector¶

The Node Inspector on the right side of the panel provides:

List of all values for each field
Search functionality to find specific values
Filter by field type
Guided pivot operations

Use the Node Inspector to:

View all unique values for a field
Search for specific values
Perform guided pivots
Understand value distribution

Use cases¶

Identify clusters¶

Find groups of related domains:

Domains sharing infrastructure
Common registrants or emails
Hosting patterns
Campaign infrastructure

Discover connections¶

Understand relationships:

How domains connect through shared attributes
Central nodes with many connections
Isolated domains or small clusters
Network topology

Pattern recognition¶

Spot visual patterns:

Star patterns (one central node, many connections)
Chain patterns (sequential connections)
Cluster patterns (tight groups)
Isolated nodes (unique attributes)

Best practices¶

Efficient analysis¶

Start with key fields: Choose 3-4 most relevant fields.
Adjust link degree: Filter out noise.
Look for clusters: Identify tight groupings.
Investigate central nodes: High-connection nodes often reveal patterns.
Use Node Inspector: List and search values.

Investigation workflow¶

Execute search: Populate Pivot Engine.
Open Visualization: Review graph structure.
Select fields: Choose relevant attributes.
Identify patterns: Look for clusters and connections.
Inspect nodes: Double-click to investigate.
Pivot as needed: Use Node Inspector for guided pivots.

What to look for¶

Interesting patterns:

Tight clusters of domains
Domains sharing multiple attributes
Central nodes with many connections
Isolated high-risk domains

Investigation targets:

Domains in the center of clusters
Nodes connecting multiple clusters
High-risk domains with many connections
Unusual connection patterns

Limitations¶

Works best with moderate result sets (< 500 domains)
Large result sets may be difficult to visualize
Performance may degrade with many nodes
Some patterns may not be visually obvious

Export visualizations¶

Visualization data is included in investigation reports:

Ensure Visualization panel is visible.
Adjust view to show desired perspective.
Generate investigation report from Product Menu.
Visualization appears in the PDF.

Note: Large result sets may not display well in report format. Download high-resolution images from the Visualization panel directly for presentations.

For more details, see Generate Investigation Reports.