The Context Graph is a centralized view of your organization's entities, relationships, and security posture. It ingests identity, device, and access data from connected sources, Microsoft Entra ID, CrowdStrike, Microsoft Defender, and Okta, among others. The graph builds a unified picture of these entities, including users, accounts, devices, applications, and groups, along with the relationships between them.

The graph is built and maintained across three layers:

The graph encodes meaning, not just topology. Relationships between entities carry typed semantics: member of, has account, has permission, so agents and analysts can traverse real operational questions rather than inferring them from free text.

The result is a single place to answer questions that would otherwise require pivoting between vendor consoles: who owns a device, what an account has access to, which entities are critical or at risk, and how far a compromise could spread. The same graph powers Auto Triage, which uses this organizational context to enrich alerts and help analysts assess severity faster, and serves as the foundation for any future agentic capability in Torq.

The Context Graph is designed to reduce friction in security investigations by centralizing context that would otherwise reside across multiple vendor consoles. These are the core capabilities it provides.

The following examples show how security teams use the Context Graph across different investigative scenarios. Each scenario is a situation where the graph replaces manual context-gathering across tools.

Two users trigger the same alert. One is a contractor with read-only marketing access; the other is a finance director with access to the M&A data room. The graph holds their roles, access, and group memberships, so the same signal produces different verdicts without manual lookup.

An analyst opens the flagged entity in the graph and immediately sees its role, group memberships, device ownership, and open cases. They confirm severity and hand off or escalate without touching a second console. For a step-by-step walkthrough, see Use Case: Entity Investigation with Context Graph.

A device is compromised. The analyst opens Risky Neighbors to see all entities within one hop that carry elevated access or weak posture, scoping the potential spread in seconds.

A service account behaves anomalously. The analyst follows its relationship edges, what it has access to, what owns it, which apps depend on it, to map how far an attacker could move.

A security engineer opens Exposed Crown Jewels to surface Critical neighbors reachable within two hops of any externally exposed account.

At least one context connector must be configured and actively ingesting data. Without a connected source, the Context Graph has no entities to display.

Available context connectors:

If your environment restricts outbound traffic, allowlist the following IPs. Context connectors call third-party API endpoints from these addresses.

To open the Context Graph, go to Investigate > Context Graph. The page opens in list view, showing all entities ingested from connected sources.

At the top of the page, Graph insights shows four cards that count entities that need attention. Select a card to filter the table to those entities. Hover the information icon on a card to see how it is defined.

The list view is the default landing. It shows all ingested entities as table rows. Use the entity type selector, filters, and search bar to scope the list to what is relevant.

Investigate an entity in two ways: review its insights and details in a card, or explore its relationships in the graph.

Selecting a row opens a card on the right with the entity’s details, without leaving the list. The card header shows the entity name and type, and two tabs organize the rest: Overview for a quick read on risk and activity, and Details for the full record. The fields vary by entity type.

The explore view shows an entity as a graph. The selected entity sits at the center, and its direct connections, such as accounts and groups, are drawn around it. Each connecting line is labeled with the relationship, for example Has account or Member of. Use it to trace how entities connect and to start an investigation from any point.

The Sources button in the top right of the Context Graph provides a real-time read on the health of ingestion across all connected sources.