# Security Fabric

> Browse the entities and relationships Vigilbase OS knows about, inspect their sources and review match proposals.

Source: https://docs.vigilbase.com/os/security-fabric

**Security Fabric** shows the model Vigilbase keeps of your environment: people, identities, devices, applications, resources and how they relate. Open it from the sidebar or press `g` then `f`. You need the `entities.read` permission.

For how the model is built, see [Environment model and Security Fabric](https://docs.vigilbase.com/os/concepts/environment-model).

## Visual fabric and inventory

Switch between two views at the top of the page:

- **Visual fabric** (the default) draws entities as a graph. Search for an identity, device or resource, filter by entity type or provider, and show 50, 100 or 200 nodes. Turn on **Open cases only** to see entities involved in open findings or investigations.
- **Inventory** is a table with **Entity**, **Type**, **Criticality**, **Owner**, **Sources** and **Last seen**. Search by name, email, hostname or ID, or filter by type.

### Read the graph

- Solid edges come from provider IDs, verified links or human confirmation. Dashed edges are uncertain matches; they need corroborating evidence before any containment action.
- Fainter edges mean lower confidence.
- Select a node to highlight what it connects to. Double-click a node to focus on its neighbourhood, at 1 or 2 hops. **Clear focus** returns to the full view.
- Use the time slider at the bottom to see the fabric as it was at an earlier event time. **Latest** returns to now.
- When a view reaches its node or edge limit it is marked **Bounded view**. Search, filter or focus on an entity to explore another part.

### Inspect a node

Selecting a node opens the inspector with three tabs:

- **Context**: provider source records, aliases and relationships, with **View source logs**.
- **Evidence**: findings, investigations and recent events for the entity. No retained events does not mean coverage is healthy.
- **Actions**: action plans that involve the entity, and **Propose action** if you have the `action.propose` permission.

Choose **Full entity** to open the entity page.

## Entity details

The entity page has these tabs:

| Tab | Shows |
|---|---|
| **Relationships** | A relationship graph at a chosen event time, and a table with each relationship's confidence and resolution method. |
| **Sources** | Every provider record that resolves to this entity, with first and last seen times. |
| **Attributes** | Values as reported by sources. Untrusted text is displayed, never executed. |
| **Aliases** | Other names and identifiers for the entity. |
| **Corrections** | Human merge, split and reject decisions that affected the entity. |

## Review match proposals

When a second provider reports something that may be the same entity, Vigilbase proposes a link. Heuristic links are not enough to target containment until a person confirms them.

:::steps
1. **Choose Match proposals.**
2. **Review a proposal.** Each card shows both records, the match **Method**, its **Confidence** and the evidence.
3. **Choose Confirm match or Reject.** You need the `entities.resolve` permission. Enter a reason; it is recorded in the audit log.
:::

Confirmed matches become human-confirmed links. Rejected matches are never proposed again for the same evidence.