Tips & Tricks for Managing Large and Complex Networks

Stacey_Parsons

As an investigator you may have found that the use of entities and networks are helpful for identifying potential risk in the investigation process, using connections across documents and entities. However, seeing all the available data connected by way of transaction flows, trades, direct links or indirect links can present its own challenges. Substantial amounts of data in a network can sometimes be difficult to navigate.

• Where do you start?
• How do you find how many hops to expand then stop?
• What do you do with the information which is no longer useful to the investigation?

Below are some tips and tricks for the latest functionality which can help simplify how to view and use networks to their full potential.

Pre-2.0

Manual Node Grouping and Node Pinning

• Node grouping allows you to manually choose nodes to group in an area, helping to simplify the network by reducing the amount of nodes showing in the network.
  • Clicking on the context panel will allow you to see what is in this grouping, you can name this group, or add or remove other nodes to this grouping.
• Node pinning allows you to ‘pin’ nodes into place. When other information or expansions are continued, the nodes pinned will stay in the same place.

An example of how to use this functionality would be:

1. You investigate one area of a network, then group it and pin it when completed.
2. Then do the same with other areas of the network.
3. The groups can be renamed, and additional documents can be added for notes on why this was done.

2.0

Perspectives - which include Entity to Entity links, Auto Node Grouping and Masking

• This allows you to simplify networks, exposing only key information in the network.
• Entity to Entity links enable entities to link directly with other entities, grouping the documents around those entities, reducing the complexity of the networks to view.
• You can work with developers to define rules to create groups automatically for a given perspective.
• An example of this would be switching to Entity-to-Entity view (as configured) which will only show Entities (and any specific documents, such as transactions) in the network with their connections. The groups can then be viewed the same as Manual node grouping, by clicking on that group, and viewing the detail in the Context panel.

Assess is the new Scoring framework introduced in 2.0. The addition of Assess includes further upgrades post 2.0 noted below.

2.1

Scoring updates

• This is a big one. You will now be able to include Scoring parameters by category and network pruning.
• This helps to reduce the ‘noise’ by only showing the information pertaining to the score vs previous, which showed everything within a specified number of hops from the focal entity or document.
• This will also allow you to highlight the associated nodes in the network, when you click on the score in the scoring panel.
  
  Please see example below:

 2.2

Timeline

• The new timeline has various ‘swim lanes’ allowing you to pick and choose which types of documents you wish to observe in the timeline.
• The timeline now supports:
  • Differentiating between events with a single occurrence and series of events related to the field.
  • Having a swim-lane per data source in the timeline you can spot patterns with ease.
  • With the new ability to zoom into a selected time range on the timeline, whether this be quarters, months, or days investigators can now drill into events which occur in quick succession or spot patterns over a time range.

Please see example below:

Read the full release notes for 2.2.

2.3

Path Ranking

• Paths are easier to identify in the Network view, and if Path Ranking is used with Network Pruning, you receive a more focussed version of the Network, with only the most important paths showing.

Please see example below:

Read the full release notes for 2.3.

2.4

Data Viewer Score filtering update

• This update allows you to highlight specific nodes in the network related to the score, as well as provides the option of altering your data source query so it is not limited to the Network shown in the UI.
• This is useful for Investigations where the Network is large and has been pruned for the UI.
• The data viewer can also be configured to show you the associated transactions/data (in the data viewer) associated with that score automatically!

Please see examples below:

Read the full release notes for 2.4.

All of these areas of functionality can be used to help increase the efficiency of investigations. We also recommend setting up shadow sessions with your friendly Customer Success manager who can show you in more detail all of the above to improve the effectiveness of traversing your network graphs even further.

Questions, comments, or feedback on making large networks more manageable? Be sure to add them below 😊

Don’t forget, if you have suggestions or ideas you would like to see implemented, you can submit them via our Ideas Portal.

Dan_Pryer

Great article @Stacey_Parsons ! The gifs really help to explain and demonstrate things clearly 👏

Adam_Lawrance-Owen

Love it Stacey - nice article. So helpful. Entity view in particular is a MUST for any complex investigations team (or anyone using Networks really ;) )