Investigation widgets

Investigation widgets summarise the events selected by an executed query. Use them alongside the event table to move between a pattern and the events that explain it.

Run a query first

1. Open Investigations → Query.
2. Enter a query, for example step_name = 'login_submit'.
3. Choose a date range containing relevant data.
4. Select Search and wait for the results.
5. Check the query, dates and row count before interpreting the visualisations.

Changing text in the editor is not the same as executing a new query. Run Search after changing the population. Shared server-side widgets calculate from the query population; they are not limited to the currently visible page of event rows. A Custom Chart built from the event grid has different data scope.

Add a shared widget

1. Select the toolbar's Add new visualization control.
2. A New Graph… tile appears. Select its settings cog.
3. Enter a Widget Name and optionally choose an icon.
4. Select Widget Type.
5. Configure the widget-specific settings, then select Save.
6. Move or resize the tile to make the result readable.

The shared choices are Aggregate Stats, Time Series (Count), Time Series (Median), Signal Trigger Rate, Top X and three Bot Type presets. For Top X, choose the required calculation under Find the….

The executed investigation query supplies the dates and event filter. Conditions inside a widget further restrict its analysis. For Signal Trigger Rate, also review the denominator and export scope described in its dedicated article.

Worked example: login activity

Run step_name = 'login_submit' for a period containing login events. Add a Top X widget named Login activity, select Velocity Of, leave grouping empty, select all event types, and use Greater than 0. Save the widget.

Use the bar/line toggle to change the presentation. To compare login outcomes, edit the widget and group by the recorded decision result. Check that the grouping attribute is populated before interpreting a missing-value series.

Additional investigation widgets

Key Identifier

Key Identifier displays selected details from a representative event. Its Mode Attribute chooses the most common attribute value in the query results; the widget uses the latest event containing that value as its sample.

1. Add a visualisation and choose Key Identifier.
2. Select the Mode Attribute, such as an account identifier appropriate to the query.
3. Select Configure Data Display.
4. Choose the fields and display blocks, arrange them, and confirm the display configuration.
5. Save the widget and inspect the selected details.

This is a representative-event summary, not a merged record of every event or a count of all identities. Choose an identifier appropriate to the investigation before treating the displayed details as a customer profile.

Entity Relationships

Choose Entity Relationships to visualise links between identifier values in the query population. Use the widget's inline configuration/menu control to choose the identifier columns that should form the network, then run the query.

Use the type controls to focus the displayed identifiers. Network Physics provides Repulsion, Edge Length and Gravity settings to make the graph readable. Hide Links with < 2 connected events suppresses single-event connections. These layout controls change the presentation, not the underlying event data.

Follow a connection into its events before inferring that two identifiers belong to the same person. Shared devices and network addresses can link otherwise unrelated accounts.

Sankey Diagram

Choose Sankey Diagram to view recorded journey-step transitions associated with the investigation query. It uses the query context and dates. It is distinct from Top X Attribute Flow, which connects attribute values within events.

The examined investigation Sankey keeps the 150 highest-volume links to avoid an unreadable graph. Narrow the query when you need to inspect a specific path; absence from this limited view does not prove a transition never occurred.

Device Map

Choose Device Map, run the query and inspect the geolocated results. Zoom and pan to focus on a region. Missing coordinates or unavailable map rendering can leave the view empty. Connection-derived locations are evidence to investigate, not guaranteed physical locations.

Custom Chart

Choose Custom Chart to chart fields from the investigation event grid. Configure the chart's data columns and chart type, then choose an aggregation such as None, Sum, Min, Max, Count, Avg, First or Last where appropriate.

Its data comes from the grid/chart selection. It is not automatically equivalent to a server-side aggregation over every matching event. Check the loaded rows, selection and aggregation before comparing it with Top X or Aggregate Stats.

Save a reusable template

After arranging the widgets and event-table columns, use Save → Save As to create a named template. Choose a descriptive name and a sharing scope you are authorised to use. Use User for personal work; an organisation template requires the relevant administration access.

The template includes configuration such as query, dates, widgets, layout and columns; it is not a frozen export of the result data. Reloading and searching can produce different results as data changes.

Editing a widget updates the current workspace. Save or update the intended template to reuse those settings later. A widget's type is fixed when editing it; add another widget when you need a different type. Remove an unwanted tile with its × control.