Skip to main content
Version: 2.20.X

Drilldown Into Events

The Drilldown widget visualizes an interactive diagram of an event's provenance, and represents the underlying events and Authoring patterns that were present and satisfied. It is most useful for understanding the "why and how" of an event's creation and processing in Cogynt.

note

The Drilldown widget (and its functionality in Object Details Viewer) does not display data if the event does not have drilldown data available. Drilldown data is produced in the Authoring application when Provenance is enabled on a pattern. It is also possible to view Drilldown data for an event from the Drilldown tab of any event opened in Object Details Viewer.

To access the Drilldown diagram for a given event (assuming Drilldown data is available), either:

Using Drilldown​

Interpreting Drilldown Widget Visuals​

The Drilldown diagram for an event displays:

  • Events as rectangles.
    • If present, risk score is depicted as both a number and as a color-coded bar at the bottom of each event.
    • The color-coded bar denotes risk level, with green being least severe, orange being more severe, and red being most severe.
  • Pattern Solutions (when enabled) as blue circular nodes. Pattern solutions represent each unique time a given pattern was satisfied.
  • Inputs and outputs to other nodes as directional arrows.

Controlling the Drilldown Widget​

The Drilldown widget offers several options for controlling how it displays and organizes information.

Organizing the Drilldown Widget​

TBD

Right-click any background area in the drilldown chart to open a context menu:

  • Click Expand All to expand all levels of the tree.
  • Click Collapse All to collapse all nodes, including child nodes.
  • Click Clear All to remove the event from the Drilldown widget. This functionality is not available when using the Drilldown tab of an event in Object Details Viewer.
  • Click Cleanup Layout to automatically recalculate and layout the nodes in the graph such that all nodes are visible.

Changing the Drilldown View​

The view within the widget can be adjusted as needed.

To zoom in or out, either:

  • Use the mouse wheel.
  • Click and drag the + and - slider on the left of the Drilldown display.

To pan the position of the view, either:

  • Click and drag the background of the drilldown.
  • Click the arrows on the left of the Drilldown display.

Viewing Node Details​

A + button to the left of any event/solution node indicates that there are multiple occurrences of the node:

  • Click + to open the node to see each unique time the event/solution was present.
  • Click - to close the node back into summary node.

A count at the bottom of any node indicates that there is another level of the tree hidden. Double-click a node to query the next level.

Right-click a node and select View Detail to open a modal and view relevant summary details from the node.

Double-click an event or node to see its connection to the root node.

Changing Drilldown Settings​

Click the Settings icon to expose a menu to customize the Drilldown display:

  • Click one of the four arrow buttons beneath Align to determine the direction that the drilldown is plotted.
  • Drag the Stretch slider to change the spacing between nodes.
  • Toggle the Hide Solutions checkbox to show or hide solution nodes. When hidden, events on the drilldown chart connect directly to each other instead of through the intermediate solution nodes.
  • Click Curve Links to toggle between straight or curved lines.