Skip to main content
Version: 2.9.X

Using Link Analysis

Link Analysis charts visualize networks of events to show their relationships to each other. They help identify key entities, or create insights about relationships. When combined with temporal analysis, charts also help illustrate how the network and relationships have changed over time.

A link chart requires entity and linkage event types, and is constructed automatically by patterns in Authoring that determine when and how entities are linked via linkage events.

It is possible for an entity to connect only through linkage events.

Assumptions​

This guide assumes:

  • That data containing entity and linkage events has been ingested into Workstation with valid linkages.
  • That the Link Analysis widget is open in a working view.

Exploring link charts helps develop a deeper understanding of a network of events. Analysts may use simple controls or carry out advanced actions to glean more detail from the Link Analysis.

To view link charts between events:

  1. From an open view containing a Link Analysis, drag an entity or linkage event into the Link Analysis. The style of each node and edge is determined by event decorations assigned to each event type.
  2. Four zones exist within the link analysis, each representing different query depths. Zone 1 queries the immediate links of the event dropped, zone 2 queries an additional layer deeper, and so on.

Note

For massive link graphs, it is recommended to start with a query depth of 1

  1. A link chart is constructed.
  2. Drag additional events onto the Link Analysis, or query additional links from any plotted node to build out the link chart further.

Basic Controls​

Navigating around the Link Analysis widget usually involves panning to new areas, selecting or studying multiple nodes, and zooming into nodes or groups for deeper analysis.

At the upper left of the Link Analysis widget, find the following controls:

  • A circle containing up, down, left, and right arrows:
    • Click the corresponding arrow to pan the link analysis screen up, down, left, or right.
    • Alternatively, click and drag the background to pan the chart.
  • Click the middle circle of the arrow to return to the default link chart state. The middle circle also returns zoomed in or out charts to their default state.
  • A square icon with a hand (✋) or pointer icon (⬉) toggles the mouse cursor to be a pointer or a drag.
    • When in drag mode, (✋), click and drag the chart to move icons or the view.
    • When in pointer mode, (⬉), click and drag a box to select multiple nodes.
  • Click and drag the vertical slider to zoom in or out of the chart. Alternatively, use the scroll wheel to zoom in and out.

Interacting With Nodes​

Each Workstation node has several associated features. The following list provides an overview of how to access them:

  • Click and drag events to reposition nodes on the chart. The chart expands and moves links as changes are made.
  • Right-click the background of the widget to open a context menu with several options:
    • Expand All expands all nodes (if there are certain nodes grouped).
    • Clear Manual Events clears out any events that were manually dragged onto the Link Analysis, as well as any additional nodes displayed.
    • Cleanup Layout resets the views layout.
  • Right-click an entity event to open a context menu with the following controls:
    • Collapse with Neighbors collapses the selected node into nearby nodes.
    • Remove Event removes the event from the view.
    • Restart with Event is a shortcut for "Clear All Events" and dropping this event.
    • Show Near Links queries the node for its immediate neighbor.
    • Show Deep Links queries the node for neighbors 6-levels deep.
    • Send to sends the entity or linkage to an open Object Details Viewer. Select one from a list of open Object Details Viewer widgets if multiple instances of this widget exist.
  • Right-click a node to open a context menu with the Send to option. This sends the entity or linkage to an open Object Details Viewer. Select one from a list of open Object Details Viewer widgets if multiple instances of this widget exist.
  • If nodes are collapsed, double-click a group to show its contents. If nodes are expanded, double-click to hide them.

Settings determine what the link chart shows, how entities can be grouped, and options affecting how the chart is visualized.

These options include:

  • Layout options include:

    • Standard charts contain nodes with consistent lengths, minimal edge overlap, and even distribution.
    • Organic charts feature larger components surrounded by a circle of smaller components to minimize whitespace and overlap.
    • Lens charts push highly connected nodes to the center of the chart, with less connected nodes outside.
    • Structural charts are similar to standard charts, but structural charts group nodes by similarity.
    • Tweak charts prevent node additions from subtly changing chart layout. This is useful for datasets consisting of 2,000 nodes or more.

  • Group By allows the selection of fields for grouping nodes.

    Note

    Multiple field selection is possible, but the order of fields toggled affects the order/level of grouping.

    Grouping requires entity and linkage events with groupable data. Any nodes that do not have a field value for the field used in grouping will display outside the grouping.

    Warning

    The Link chart may become non-performant at a high volume of data (20,000+ nodes). It is recommended to minimally utilize "Group by" Event Definition to maintain performance at high volumes of data.

  • Show Entities allows analysts to hide or show entity nodes of a particular event type.

  • Show Linkage Events allows hiding or showing linkage event nodes of a particular event type.

  • Node Spacing manually adjusts the spacing of nodes. Lower values decrease the space between nodes, while higher values increase the space.

  • Entity Node Size manually adjusts the size of entity nodes. Lower values decrease the size of the node, while higher values increase the node's size.

  • Link Node Size manually adjusts the size of link nodes. Lower values decrease link node size, while higher values increase link node size.

  • Combine Links attempts to aggregate linkage events between entities based on the number of occurrences of each linkage event between entities.

    Note

    This feature may not be helpful if the link graph contains linkage events that have more than two entities connected at once.