Exporting a graph to IBM i2 Analyst’s Notebook

You can save the graph that is currently displayed in the Graph Browser with all lenses applied and download it as an ANB graph file, which is compatible with IBM i2 Analyst’s Notebook.

To use this feature, you must first enable the i2 Integration plugin. Complete the following steps:

  1. Open the config/investigate.yml file.

  2. Set the parameter for the i2_integration as follows:

    i2_integration:
  enabled: true

  3. After the feature is enabled, you can click To IBM i2 to save the graph as an ANB file.

  4. Specify a name for the file and click Download.

Configuring the i2 export

You can configure the i2 export settings by clicking Management → i2 Export.

From this page, you can set up the details of the conversion process from Siren Investigate objects to i2-compatible entities. You can also specify the attributes that are associated with them.

Configuring the i2 export feature

  1. Select a saved search or EID node from Siren Investigate.

  2. Manually configure the mapping by using a JSON string.

  3. Select the i2-compatible entities that you want to map to.

While you are editing the export configuration, open another browser tab to display the Data model app, so that you can reference the saved search fields.

You can add, remove, or edit mappings as needed.

The mappings for a Siren Investigate object consist of a raw JSON string, which can be edited manually.

Example of mapping with JSON

It is composed of the following parts:

  • typeName: Identifies the i2 entity type that will be used for nodes of the specified Siren Investigate object. This automatically picks the correct i2 default icon for the specified entity type. You can also specify a non-default type, but you must then apply icon and entity details yourself after loading an exported file in i2 Analyst’s Notebook.

  • typeNameAsLink: Identifies the type of link to be used when the Graph Browser lens Associate records based on ontology lens is active and this Siren Investigate object gets used as a link.

  • description: The description that is associated with a node, provided as a field name or a Java Expression Language (JEXL) expression.

  • dateTime: The date and time values that are associated with the node, provided as a field name or a JEXL expression.

  • attributesMap: A key-value dictionary where the keys are the names of the i2 attribute classes to associate to the object, and the value is either a field name or a JEXL expression that is calculated from Siren Investigate record data.

JEXL expressions are specified with an explicit JEXL property and support the same syntax as the Graph Browser lenses. For more information, see Configuring JEXL operators.