Graph customization

The Customize button lets you customize the graph view.

Figure 1. Customization settings (Network graph version shown)

Graph customization panel with options to change layout and toggle filters, nodes, and links in the Vantage graph view.

The Customize button opens a menu of settings that you can choose from to change the graph view. These settings let you change the appearance and structure of the network graph for more effective data interpretation.

Filters

Use filters to restrict the visible assets and links based on selected criteria. This helps reduce visual clutter and focus on relevant areas of the network.

If several filters of different types are selected, a logical AND is applied.

If several filters of the same type are selected, a logical OR is applied.

Figure 2. Filter dropdown

Filter dropdown menu showing selectable criteria such as Asset ID, IP, Subnet, Vendor, Firmware version, Product name, MAC address, Operating system, Zones, Roles, and more.

Once a filter is selected, one of these items will become active to the right:

  • A dropdown that lets you make a further, related selection
  • A text field that let's you enter and search for custom text
Figure 3. Choose dropdown/ text field

The choose dropdown that shows options related to alert risk

Node perspectives

Figure 4. Nodes perspectives dropdown

Dropdown menu for selecting node perspectives in a network graph, including options like alerts, assets, and vulnerabilities.

Select the property that changes the color of the nodes in the graph. This setting controls the perspective from which nodes are visually and semantically organized. You can choose how the color of individual nodes show in the graph:

  • Roles – Color nodes based on assigned roles, such as client, server, or gateway
  • Types – Color nodes according to their device type (e.g., switch, sensor, workstation)
  • Zones – Color nodes by logical zones, often reflecting segmentation policies or network architecture
  • Level – Color nodes based on hierarchical levels, such as Purdue model layers
  • Appliance host – Color nodes based on the monitoring appliance that discovered or manages them

Layouts

Select one of the available graph layout types to change how assets and links are visually arranged:

Standard: Default arrangement based on connectivity.

Grouped: Group nodes based on the Group by selection. Nodes will be grouped in different circles based on the value of the defined property. For example, if the property is Zones, nodes that belong to the same zone will be put in the same circle.

Clustered: The nodes are hierarchically grouped in clusters based on the topology. If a Group by is defined, this sets the first level of the hierarchy.

Purdue (Network graph only): Follows the Purdue model for industrial control system layers.

Hops

The Hops settings lets you adjust the number of connection hops shown in the graph in any filtered view. The settings let you start with a focused set of assets and progressively discover additional connections. This makes it easier to investigate relationships without losing context. The lowest setting is 1 and not 0. This is because a graph with a single isolated node has no value. Therefore, by default you will see the node 1.1.1.1 with the first level of connected nodes. When you increase the setting to 2, the nodes that are connected to all the first level nodes will also show.

From the start position, you not only see what you have filtered, but the first level of connected nodes. For example, if you filter with the internet protocol (IP) address: 1.1.1.1, you will not just see the single isolated node 1.1.1.1, but also the first level of connected nodes.

Link perspectives (Network graph only)

Figure 5. Link perspectives dropdown

Dropdown menu for selecting link perspectives in a network graph, showing options such as inbound, outbound, and all traffic types.

Select the property that changes the color of the links in the graph. Link perspectives help illustrate different types of relationships or communication flows between devices. You can choose how the color of individual links show in the graph.

Group by

Figure 6. Group by dropdown

Dropdown menu showing options to group nodes in the graph, including categories like zone, site, and system type.

Dynamically group nodes in the graph by specified metadata such as device type or subnet. This feature enhances pattern visibility and makes it easier to detect anomalies or segment relationships.

When Group by is defined, the result will depend on the selected layout:

Standard: All nodes with the same Group by value will be condensed into a single node. For example, if the Group by is Roles, then all the nodes with the same role will be condensed into a single node.

Grouped: All nodes with the same Group by value will be put in the same circle. For example, if the Group by value is Zone, then all the nodes that belong to the same zone will be put in the same circle.

Clustered: All nodes with the same Group by value will be put in the same first level cluster of the cluster hierarchy.

Purdue: Nodes will show in different circles based on their level. Circles will show in a three dimensional view.