Security Fabric shows the model Vigilbase keeps of your environment: people, identities, devices, applications, resources and how they relate. Open it from the sidebar or press g then f. You need the entities.read permission.
For how the model is built, see Environment model and Security Fabric.
Visual fabric and inventory
Switch between two views at the top of the page:
- Visual fabric (the default) draws entities as a graph. Search for an identity, device or resource, filter by entity type or provider, and show 50, 100 or 200 nodes. Turn on Open cases only to see entities involved in open findings or investigations.
- Inventory is a table with Entity, Type, Criticality, Owner, Sources and Last seen. Search by name, email, hostname or ID, or filter by type.
Read the graph
- Solid edges come from provider IDs, verified links or human confirmation. Dashed edges are uncertain matches; they need corroborating evidence before any containment action.
- Fainter edges mean lower confidence.
- Select a node to highlight what it connects to. Double-click a node to focus on its neighbourhood, at 1 or 2 hops. Clear focus returns to the full view.
- Use the time slider at the bottom to see the fabric as it was at an earlier event time. Latest returns to now.
- When a view reaches its node or edge limit it is marked Bounded view. Search, filter or focus on an entity to explore another part.
Inspect a node
Selecting a node opens the inspector with three tabs:
- Context: provider source records, aliases and relationships, with View source logs.
- Evidence: findings, investigations and recent events for the entity. No retained events does not mean coverage is healthy.
- Actions: action plans that involve the entity, and Propose action if you have the
action.proposepermission.
Choose Full entity to open the entity page.
Entity details
The entity page has these tabs:
| Tab | Shows |
|---|---|
| Relationships | A relationship graph at a chosen event time, and a table with each relationship's confidence and resolution method. |
| Sources | Every provider record that resolves to this entity, with first and last seen times. |
| Attributes | Values as reported by sources. Untrusted text is displayed, never executed. |
| Aliases | Other names and identifiers for the entity. |
| Corrections | Human merge, split and reject decisions that affected the entity. |
Review match proposals
When a second provider reports something that may be the same entity, Vigilbase proposes a link. Heuristic links are not enough to target containment until a person confirms them.
Choose Match proposals.
Review a proposal. Each card shows both records, the match Method, its Confidence and the evidence.
Choose Confirm match or Reject. You need the
entities.resolvepermission. Enter a reason; it is recorded in the audit log.
Confirmed matches become human-confirmed links. Rejected matches are never proposed again for the same evidence.