# Siren Platform User Guide

### Siren Investigate Graph Browser

The graph browser displays Elasticsearch documents as nodes and Siren Investigate relations as links of a graph.

### Configuration

#### Big nodes threshold

If a node would expand into more than this configured number of nodes it will be considered a big node and the user will be given a choice to proceed or to select a sample.

#### Relations

You can configure the ontology relations you want to use in this visualization. If no relation gets set, they will all be used.

#### Scripts

The Graph Browser supports three types of scripts:

• Expansion: Used to customize the expansion policy. The provided one (Default Expansion Policy) will retrieve the first level connected elements to the expanded nodes
• Contextual: Displayed in the contextual menu (shown with a RIGHT CLICK). Enable you to perform operations on the graph. Provided contextual scripts:

• Expand by relation: Opens a popup that enables you to choose one or more of the available relations and expands the selected elements using only the selected ones. This does not override the graph browser configuration. You will see only the configured relations (if available for the selected nodes).
• Expand by top comention: For use with company nodes from the Siren demonstration data. This script expands the selected nodes using an Elasticsearch aggregation to get the top comentioned company nodes.
• Replace investment with edge: For use with the Siren demonstration data. This script replaces the investment nodes with a direct link between the company nodes and the investor nodes.
• Select - All: Select all the elements (equivalent to Ctrl+A).
• Select - By edge count: Select nodes based on their link count. You can specify the count through the popup that appears.
• Select - By type: Select nodes based on their type. You can specify the type through the popup that appears.
• Select - Extend: Extends the current selection to the sibling elements.
• Select - Invert: Inverts the current selection.
• Shortest Path: Calculates the shortest path between two selected nodes by fetching the connected elements.
• Show nodes count by type: Shows a popup with information about how many nodes per type are currently displayed.
• Lenses:Lenses mutate the visual appearance of graph nodes and edges, can be cascaded as well as switched on and off at will during investigation. Provided lens scripts:

• Size lens: Set the size for all nodes using an expression.
• Color lens: Define color for all nodes using a field.
• Conditional lens: Set node properties using expressions.
• Label lens: Set the label for all nodes using an expression.
• Associate records based on ontology lens: Replaces a node with associated records based on ontology.
• Time and location lens: Set time and location properties.
• On Update: Modify the graph when new nodes are inserted. They can be cascaded. Provided on update scripts:

• Add time fields: Adds the time field used by the timebar mode.
• Add geo-locations for map visualization: Adds the geographic field used by the map mode.
• Replace investment with edge: Similar to the contextual script Replace investment with edge, but executed automatically after every expansion.
• Signal dead companies: Colors all the company nodes that have a deadpooled_date black.

To create a new script go to ManagementScripts

Here you can configure new scripts or modify the saved ones.

#### Fields to exclude

You can configure a set of fields for each entity that you do not want to retrieve. Typically, you will exclude large fields that do not contribute to the link analysis (for example large textual blobs, technical metadata)for extra performance.

### Navigating the Graph

#### Toolbar

You have several operations available:

1. Undo: By default, the graph browser saves the last five states. With this function you can go back one step at a time, until there are no more available. You can configure the steps number in ManagementAdvanced Settings.
2. Redo: Revert an undo. Note, if you undo and then perform any operation, the redo state will be lost.
3. Filter: Add a filter to the current dashboard synchronized with the graph selection. This enables you to:

• Do your investigation on the graph, select the vertices you are interested into, activate the filter, pin it and go back to the related dashboard to get more detailed information about those vertices.
• If you have other visualizations in the same dashboard, it will let you have more information on the selected nodes. For example, if you have the current dashboard associated with a companies saved search, you can do your investigation in the graph, activate the filter, select some vertices and get the visualizations to show information on the selected vertices.
4. Crop: Removes every element that is not selected
5. Remove: Removes all the selected elements. Next to the Remove button there is a box that shows the Remove All button. This will remove the entire graph, regardless of selected elements.

6. Expand: Expands the currently selected nodes. Next to the expand button, there is a box that shows advanced options for the expansion.
7. Highlight mode: This toggles the Highlight mode. The Highlight mode moves everything to the background that is not selected or connected to a selected node or link.

8. Layouts: Enables you to change the current graph’s layout or redraw the current layout:

• Standard (default): Selected nodes preserve their relative position.
• Hierarchy: Nodes are displayed top down according to their connections. Requires at least one selected node to work. Selected nodes will be moved at the top of the hierarchy.

9. Add: Opens a dialog with the following options:

• Add selected document: Add the currently selected document. You can see your selected document in the upper right purple selection box.
• Add from saved graph: Opens a dialog showing the available saved graphs. This feature adds a set of nodes and links, but does not preserve the layout you had when you saved the graph.
• Add from another dashboard: Adds nodes using the dashboard (optionally filtered) that you select.

10. Map Mode: This toggles the Map mode. The Map mode will move the nodes geographically on an interactive map. You must set up a script to configure the geographic properties of the nodes (See Siren Investigate Graph Browser).

11. Timebar Mode: This toggles the Timebar mode. This mode displays a time bar at the bottom of the graph browser that enables time based filtering of nodes. After you enable this mode you can add or remove node types to the time bar:

Timebar filter

You must set up a script to configure the time property of the nodes (See Siren Investigate Graph Browser).

12. Save graph: Save the current graph.

13. Open graph: Open a saved graph. Unlike add from saved graph, this feature preserves the saved graph layout.

#### Shortcuts

The graph browser supports shortcuts:

• Ctrl+A: Select every element in the graph.
• Del: Remove the selected elements (equivalent to the remove button).
• Ctrl+: Enables you to add elements to the current selection. Can also be used to create an OR filter from a selection.
• : Expands the selected nodes (equivalent to the expand button)
• Arrows: Move the selected elements in the input direction.
• : Changes the zoom level of the graph.

The navigation bar enables you to:

1. Move the graph view in the clicked direction.
2. Switch between:

• Arrow: Enables you to select elements.
• Hand: Enables you to move the graph regardless of selected elements.
3. Enables you to change the zoom level.

#### Side bar

The side bar enables you to:

• Show, search, filter, sort, group and change node/links data.
• Change the current selection.
• Change node/links attributes (i.e: Color, label, tool tip, and so on).
##### Lenses tab

The lenses tab enables you to make alterations on the displayed nodes/links:

• Color: Enables you to select a field which is then used to color the nodes using a coloring schema.
• Conditional: Enables you to change a node property value using configurable expressions.
• Label: Enables you to set the node label using an expression.
• Size: Use a log scale to adjust the node’s size according to an expression.
• Spatio-Temporal: Enables you to set the node time and/or geographic location from field values.
• Associate records based on ontology: Enables you to replace a node with a relation between two of its children.
• Graph metric: Enables you to apply metrics to the graph including:

• Betweenness

• Closeness

• Connectiveness

• Degrees

• Eigenvector

• Pagerank

###### Lens parameters

Each lens has specific parameters which will be used for every graph node.

###### Conditional lens

A conditional lens can change a property for all the nodes that satisfy the condition:

• Color
• Node font icon
• Node glyphs
• Hidden
• Label
• Location
• Node image
• Size
• Time
• Tooltip
###### Associate records based on ontology lens

The associate records based on ontology lens can use the node’s underlying model, as in the following example, to replace a node with the relation between two of its children.

#### Investment model graph view

After you configure the lens, two nodes and its relationship will be displayed. For example, apply this lens an investment node:

You could obtain the associate records based on ontology as a result:

#### Expansion tab

The expansion tab controls how nodes expand when you double-click them or select a group of nodes and click Expand.

• Dashboard filters: Restrict nodes produced by an expansion to those present in the selected dashboard.

• Relations - simple: Restrict nodes produced by an expansion to the selected relations.

• Relations - aggregated: Quickly show aggregates on graph edges that summarize groups of intermediate nodes.

##### Selection tab

The selection tab enables you to show, search, filter, sort, group and change node/links data. When this tab is opened, it reacts with your current node selection and loads the data in rows and columns.

The main component is the data grid, every grid’s row represents a node in the graph and every column a field data related information.

##### Document type selection

The Main selection combo box enables selection between the different document types in the selected nodes.

##### Selection change

The second column in the grid enables multiple row selection, once selected it will reflect on the graph turning each node bigger and changing the node’s border to red.

After you complete the selection, you can click the Make main selection button floating over the grid to remove the non-selected nodes.

##### Global filter

Typing in the Filter input enables you to search/filter in all rows and columns.

##### Local filter

Typing inside of one column’s input enables you to search/filter in all rows of that column.

This menu enables you to show or hide columns and clear all local filters.

The menu options enable you to:

• Change the sort order -Multiple column order is supported by keeping shift key pressed on column selection-.
• Hide the column.
• Group the data.
• Add aggregated function, the result of which will be displayed at the bottom.
• Pin the column to the left or right side of the grid.
##### Lens Expressions

Siren Investigate’s lens expression parser is based on Jexl.

The expression created within the lens is applied to each node of the selection. Each node contains an object named payload which contains the node’s data returned from Elasticsearch.