Entities & Entity Graph

Entities are the artifacts extracted from security events: users, hosts, IP addresses, domains, file hashes, and more. nano extracts entities from an alert's matched events and graphs their relationships.

Entity Types

Type	Icon	Description	Examples
User	Purple circle	User accounts and identities	`admin`, `jsmith@corp.com`
Host	Blue circle	Hostnames and computer names	`SRV-PROD-01`, `LAPTOP-ABC123`
IP	Green circle	IP addresses (v4 and v6)	`192.168.1.100`, `10.0.0.1`
Domain	Orange circle	Domain names	`evil.com`, `api.example.org`
Hash	Gray circle	File hashes (MD5, SHA1, SHA256)	`a1b2c3...`
URL	Purple square	Full URLs	`https://evil.com/malware.exe`
File	Blue square	File paths and names	`/tmp/payload.sh`
Process	Green square	Process names	`powershell.exe`, `cmd.exe`
Email	Orange square	Email addresses	`attacker@evil.com`

Entity Extraction

Entities are automatically extracted from matched events when alerts fire:

Extraction Sources

Entities come from two passes: named UDM fields, and a regex sweep over every string value in the event (which catches public IPs, URLs, hashes, and emails wherever they appear, including in message).

Field	Extracts To
`user`, `src_user`, `dest_user`, `user_name`	User entity
`src_host`, `dest_host`	Host entity
`src_ip`, `dest_ip` (plus IPs found by regex in any string)	IP entity
`url_domain`, `sender_domain`, `recipient_domain`	Domain entity
`file_hash`, `process_hash` (plus MD5/SHA1/SHA256 found by regex)	Hash entity
`url` (plus URLs found by regex in any string)	URL entity
`file_path`, `file_name`, `process_path`, `parent_process_path`	File entity
`command_line`, `process_name`, `parent_command_line`, `parent_process_name`	Process entity
`sender`, `recipient` (plus emails found by regex in any string)	Email entity

The regex sweep skips private and loopback IPs to cut noise, so internal addresses are picked up only from the explicit src_ip / dest_ip fields.

Extraction Logic

// IPs: from explicit UDM fields, plus a regex sweep over string values
if event.src_ip / event.dest_ip is a valid IP → add IP entity
for each IP matched by regex in any string value:
    if not a private/loopback IP → add IP entity

// Domains: from UDM domain fields only (not a message regex)
for field in [url_domain, sender_domain, recipient_domain]:
    if value looks like a domain and not an IP → add Domain entity

// Hashes: from hash fields, plus regex (longest hash type wins, dedup'd)
if event.file_hash / event.process_hash looks like a hash → add Hash entity
for each MD5/SHA1/SHA256 matched by regex in any string value:
    add Hash entity (lowercased)

Entities Panel

The entities panel in the case detail view shows all extracted entities grouped by type:

┌─────────────────────────────────┐
│ ENTITIES                        │
├─────────────────────────────────┤
│ ▼ Users (3)                     │
│   ⭐ admin@corp.com        (15) │
│      jsmith               (3)   │
│      service_account      (1)   │
│                                 │
│ ▼ Hosts (2)                     │
│      SRV-PROD-01          (8)   │
│      LAPTOP-ABC123        (4)   │
│                                 │
│ ▼ IPs (5)                       │
│      192.168.1.100        (12)  │
│      10.0.0.1             (5)   │
│      203.0.113.42    [G]  (3)   │
│      ...                        │
│                                 │
│ ▼ Domains (1)                   │
│      evil.com        [!]  (2)   │
└─────────────────────────────────┘

Panel Features

Feature	Description
Counts	Number in parentheses shows occurrence count
Primary Entity	Star icon marks the primary entity for the case
Enrichment Icons	Globe for geo-enriched IPs, warning badge for threat intel matches
Click Action	Click any entity to pivot to search
Double-Click	Opens new search tab filtered to that entity

Entity Graph

The entity graph provides a visual representation of relationships between entities:

                    ┌─────────────┐
                    │    admin    │
                    │   (User)    │
                    └──────┬──────┘
                           │
              ┌────────────┼────────────┐
              │            │            │
        ┌─────┴─────┐ ┌────┴────┐ ┌─────┴─────┐
        │ SRV-PROD  │ │ LAPTOP  │ │  10.0.0.1 │
        │  (Host)   │ │ (Host)  │ │   (IP)    │
        └─────┬─────┘ └─────────┘ └───────────┘
              │
        ┌─────┴─────┐
        │ evil.com  │
        │ (Domain)  │
        └───────────┘

Graph Features

Node Visualization

Color: Indicates entity type (see table above)
Size: Larger nodes have more occurrences
Border: Highlighted for primary entities
Tooltip: Hover for entity details and enrichment

Interactions

Action	Result
Drag	Move node, graph adjusts
Click	Highlight node and connected edges
Double-click	Pivot to search for entity
Scroll	Zoom in/out
Pan	Click and drag background

Controls

Reset View: Return to default zoom/position
Export PNG: Save graph as image
Layout Toggle: Switch between force-directed and hierarchical layouts

Edge Relationships

Edges (lines) connect entities that appear together in the same events:

Edge Type	Meaning
User ↔ Host	User authenticated to or acted on host
Host ↔ IP	Host has/had this IP address
Host ↔ Domain	Host communicated with domain
IP ↔ Domain	Domain resolved to IP
Process ↔ File	Process accessed/created file

Edge thickness indicates connection strength (more co-occurrences = thicker line).

Primary Entity

Each case has a primary entity - the most significant entity for that investigation:

Selection Logic

Type preference order: Host > User > IP > Domain > Hash (the first type present wins)
Within a type, the entity with the highest occurrence count
Can be manually overridden by analysts

Use Cases

Grouping key: The primary entity often determines case grouping
Title generation: Auto-generated case titles append the primary entity context (e.g. user@host)
Dashboard filtering: Filter cases by primary entity type

Entity Enrichment

Entities are automatically enriched when applicable:

IP Enrichment

If IP enrichment is configured, external IPs receive:

Country/Continent: Geographic location
ASN: Autonomous System Number and name
Risk Score: From threat intelligence feeds

Domain Enrichment

Domains may be checked against:

Threat intel feeds: Known malicious domains
Prevalence: How common in your environment

Hash Enrichment

File hashes can be looked up in:

Threat intel feeds: Known malware hashes
VirusTotal: (if configured)

Viewing Enrichment Data

Click an enriched entity to see details:

┌─────────────────────────────────────┐
│ 203.0.113.42                        │
├─────────────────────────────────────┤
│ Type: IP Address                    │
│ Occurrences: 12                     │
│                                     │
│ Enrichment:                         │
│   Country: Russia                   │
│   Continent: Europe                 │
│   ASN: AS12345                      │
│   AS Name: Example ISP              │
│   Risk Score: 75/100                │
│                                     │
│ Actions:                            │
│   [Search] [VirusTotal] [Whois]     │
└─────────────────────────────────────┘

API Reference

Get Case Entities

Entities are returned grouped by type as part of the full case detail:

GET /api/cases/:id

The entities field holds one EntityTypeSummary per type, each with a count and the entities themselves:

{
  "entities": [
    {
      "entity_type": "user",
      "count": 1,
      "entities": [
        {
          "entity_value": "admin@corp.com",
          "occurrence_count": 15,
          "is_primary": true,
          "risk_score": null,
          "enrichment_data": null
        }
      ]
    },
    {
      "entity_type": "ip",
      "count": 1,
      "entities": [
        {
          "entity_value": "203.0.113.42",
          "occurrence_count": 3,
          "is_primary": false,
          "risk_score": 75,
          "enrichment_data": {
            "country": "Russia",
            "asn": "AS12345"
          }
        }
      ]
    }
  ]
}

Querying Entities

Use the search interface to find cases by entity:

Entity values and types are recorded on entity_added audit events (see Audit Events).

Find Cases with Entity

source_type=audit source=case action=entity_added entity_value="admin@corp.com"
| stats count by case_id

Find All IPs in Cases

source_type=audit source=case action=entity_added entity_type=ip
| dedup entity_value
| table entity_value, case_number

Entity Occurrence Ranking

source_type=audit source=case action=entity_added
| where entity_value != ""
| stats count by entity_type, entity_value
| sort -count
| head 20

Compromised accounts (user hub)
Infected hosts (host hub)
C2 servers (IP/domain hub)

5. Export Graphs

Use "Export PNG" to include entity relationships in reports and tickets.

Entities & Entity Graph

Entities & Entity Graph

Entity Types

Entity Extraction

Extraction Sources

Extraction Logic

Entities Panel

Panel Features

Entity Graph

Graph Features

Node Visualization

Interactions

Controls

Edge Relationships

Primary Entity

Selection Logic

Use Cases

Entity Enrichment

IP Enrichment

Domain Enrichment

Hash Enrichment

Viewing Enrichment Data

API Reference

Get Case Entities

Querying Entities

Find Cases with Entity

Find All IPs in Cases

Entity Occurrence Ranking

Best Practices

1. Review Primary Entities

2. Use Entity Graph for Correlation

3. Pivot Freely

4. Watch for Hub Entities

5. Export Graphs

On this page