Scenario
A SOC analyst receives an alert on a user account flagged for suspicious login activity. Before escalating or closing the case, they need to know who the account belongs to, what it has access to, and how far a compromise could spread. That context is distributed across identity, endpoint, and access tools.
The Context Graph centralizes it. Without leaving the page, the analyst can locate the entity, review its attributes and sources, and trace its connections across every ingested data source.
Challenge
The analyst needs to:
Locate the flagged entity without logging into multiple consoles.
Confirm its type, posture, and access in one view.
See its group memberships, device ownership, and linked accounts.
Scope how far a compromise can spread before deciding on severity.
Prerequisites
At least one context connector must be configured and actively ingesting data. Without a connected source, the Context Graph has no entities to display.
For a list of available context connectors, see Context Graph.
Investigation flow
The following steps walk through a typical entity investigation, from opening the Context Graph to tracing connections across your environment.
Open the Context Graph: Go to Investigate > Context Graph. The page opens in list view, showing all entities ingested from connected sources.
Locate the entity: Paste the account’s email or username from the alert into Search all entities. If several rows match, set Entity type to Person. To browse privileged identities instead, select a Graph insights card, such as Identities with admin access, to filter the list.
Display the entity card: Click the matching row. The card opens on the right with the entity’s name, type, and email, which confirms the match with the alert before reading further.
Review insights and activity: On the Overview tab, read Criticality, Posture, and Privileged, along with the reason shown beside each value. Activity shows whether the entity is active and when it was first and last seen.
Review access and sources: Open the Details tab. Access shows whether the entity has admin access. Sources lists the connectors that reported the entity, each with its sync status. A source marked Limited, Degraded, or Error means the data may be incomplete.
Open the graph: Click Open in graph. The graph opens in a new tab with the entity at the center. Its direct connections, such as linked accounts and groups, surround it, and each line is labeled with the relationship, for example Has account or Member of.
Surface more connections: Work outward from the center:
Expand a connected entity, such as a group, to add its connections to the view.
Filter by Criticality, Posture, Privileged, or Entity type to bring forward the neighbors that matter.
Restart with this entity on a neighbor to continue the investigation from it. A confirmation prompt appears before the graph clears.
Outcome
This investigation gives the analyst:
A single view of the entity's identity, access, and posture across all connected sources.
A map of direct connections, including group memberships, device ownership, and linked accounts.
A scoped blast radius showing how far a compromise can spread from the flagged entity.
A map of the entity's connections, traced hop by hop to judge exposure.
The context needed to escalate, close as a false positive, or hand off to a deeper investigation.
Related: Better verdicts with Auto Triage
The same graph that powers manual investigation also improves Auto Triage verdicts.
Auto Triage weighs entity context when it sets the verdict and severity. A Critical or Privileged entity raises the risk, so the same alert on a low-access account is usually rated lower. Auto Triage reads entity context from the Context Graph before producing a verdict. An entity flagged as Critical or Privileged receives a higher-severity verdict than an otherwise identical alert on a low-access account.
For automated post-verdict investigation using AI Agents, see Use Case: Post-Verdict Investigation with AI Agents.