General Overview of Gemini Explore

Gemini Explore forms part of our Gemini Enterprise offering and has been specifically designed from the ground up to offer a rich visual experience in which to explore and investigate your data.

Using this dynamic multi-layer visualization tool technology, the user is able to drill-down and interact with data. For instance, double-click a User node and discover to which servers and personnel they are connected.

This process is intuitive to use, as it mimics the way our brains ‘think’. When we discover something interesting, we instinctively need to know how this occurred or to what it is connected. Using Explore, we can simply 'click' a node on the canvas to discover its context and reveal more information.

 

Data Modeling Dashboard

Gemini Explore has a Data Modeling dashboard built-in, used to create the Sources, Models, Commands and Flows required under the hood, as described in detail within our Gemini Explore - User Guide.

Also available is the 'Art of Data Modeling' document that focuses specifically on model creation, using a series of use cases and examples. Both are available as PDF downloads from many of our recent Support Portal documents.

The current document assumes that the underlying model components have already been created and specifically refers to how a user interacts with the Exploration dashboard and its associated canvas.

 

The Exploration Dashboard

This is where your visual investigation journey begins. To start the process you may have a use-case in mind, such as a User or Host that you wish to investigate.

For example, search for a relevant node category from the Tags panel, and to narrow down the search, it may be necessary to show or exclude nodes using the search panel, where a node can be any discernible ‘thing’ that exists on your Graph.

The example here shows nodes from a Movie database making up the view on the Canvas.

In the left-hand margin, Explore has two panels; a Search Panel used to filter results, and a Tags Panel used to manage the Node categories that have been made available by the underlying Models.

On the right, the Navigator helps to contain the view of multiple nodes on the canvas, and the Profiler gives a greater insight into the Properties and relationships of a selected node.

A Toolbar runs along the top of the screen, and these all surround a central Canvas.

 


Search and Tags Panels

The ‘Show’ entry box will be the usual way of driving investigations across your data. This will restrict implicit chosen nodes within their Node Categories, linked by a logical ‘OR’. For instance just Movie or Director.

To add Node Categories, locate and highlight them from the Tags Panel. Then use the ‘+’ icon adjacent to the node name to add to the search criteria.

The Exclude search box will apply a logical ‘NOT’ for selected nodes. This is not as efficient as the previous ‘Show’ option, as it will bring back all nodes except those stated.

It is also possible to search by Relationship rather than by Node Category. This option might be used to supplement the detail of a search by node, or you may choose to use this method from the beginning of your investigation with this option from the Tags panel header, locate and highlight the relationship required from the data Panel, and add to the canvas using the ‘+’ icon.

To reset your search criteria at any time, click the Reset button.

 

Working with the Exploration Canvas

There are several ways to work with the Canvas; a combination of shortcut keys, mouse or trackpad, and the upper Toolbar.

Before we start to examine navigation techniques available, here are some general terms to which we will be referring.

General terms used with Explore

Setting Notes on using this setting
node/Node The representation of a discernible unique ‘thing’ on the canvas
Relationship A connection between two nodes that describes how they are related. This is presented by an interconnecting line on the graph which includes the relationship direction. Select to engage the Profiler detail.
Property Usually a useful metric or information that enhances the node/Node
Label The value representing the source header/field of the node.
Tag A human definable name representing Node Categories that allow users to quickly navigate and understand the canvas.
Annotations An annotation is used to enhance a Node.

It can take the form of an image, video, or text comment.
Graphs As viewed through the Profiler, this will list the Saved Graphs in which a node is used.

 

Navigating the Exporation Canvas

There are several options available to navigate the canvas.

  • Keyboard & mouse controls (including shortcut keys)
  • Right-click Menu
  • Explore Toolbar

As a simple example of this, a common requirement is to clear the Canvas completely, use either of the bulleted options to achieve the task:

Clearing the Canvas

  • Click anywhere on the Canvas and type ‘e’
  • Locate and click the ‘Clear Canvas’ icon on the Explore Toolbar
  • Open the 'ellipsis' menu, and choose 'Clear Canvas'

You will quickly develop your own preferences when using the product, so we shall now explore some more navigation actions.

Manipulating the Graph

  • Hold the space key down on your keyboard, while you click-and-drag your mouse (or trackpad) on the Graph display.
  • Locate the Navigator Panel. Click and drag your mouse within this panel to highlight the area of canvas you wish to select.
  • Locate the Toolbar and choose the ‘Pan’ (hand) icon. Then click-and-drag your mouse over the canvas
  • Hold the 'alt' key together with '1', to create the maximum zoom for all observed nodes on the canvas

Zoom control of the Graph

  • Click anywhere on the Canvas and type ‘z’. Click the mouse again to zoom by increments.
  • Locate the Navigator Panel, and click the ‘Zoom to fit all’, or the 'Zoom to Fit Selected' icons.
  • Locate the Explore Toolbar and choose the ‘+’ magnifying glass icon. Then click on the Graph to increase the zoom.

Selecting Nodes on the Graph

  • Select one of the Nodes with your mouse (you may first need to choose the mouse Select Pointer from the Explore Toolbar). The selected Node will be color highlighted.
  • Observe the Node List Panel, and search for an individual node using the Search Show box. Select the 'Search' button to run the search and add it to the canvas.
  • Locate the Explore Toolbar and search for a Node using the, ‘Select nodes by Keyword’ box.
Type ‘i’ at any time to isolate your selection and clear everything else

Working with a group of nodes

  • Using your mouse, click-and-drag a selection rectangle around several nodes or hold down the 'SHFT' key and select individual nodes. The selected nodes will be color highlighted.
  • 'Right-click' the canvas to reveal various options. In the example below 4 nodes have been selected

  • Select or Press 'i' - To isolate those selected nodes
  • Select or press 'W' - To Discard these and leave the remaining nodes
  • Select or press Cmd/Ctrl 'G' - To create a Group that can be minimized and expanded
  • Select 'Save Selection' - To initiate this as a 'Saved Graph'
Type cmd + z to undo the last step at any time (ctrl + z on Windows)

Using your mouse controls to select and group together nodes is usually the fastest way to navigate, but it takes some practice. See below for a guide as to what can be achieved.

Working with Relationships

Relationships between the nodes, shown graphically as lines, might form your initial use case for an investigation. For instance, if you were looking for current ‘authenticated connections’

  • From the Tags Panel, change the selector to ‘Relationships’. Locate a Node Category involving authentications. If it has a number in brackets, this will be the total number it knows about. Use the small ‘+’ icon to add this to your Search box, and known relationships and their corresponding nodes will appear on the Canvas.

To extend the Relationships currently displayed for a node.

  • Select the required node, and right-click to choose ‘Explore Relationships…’. This will expand a list of possible relationship types such as a Group or Parent.

To discover more about the Relationship, in other words, the date and time of the authentication, and the status of that authentication.

  • Select the connecting line between nodes. Review information about this Relationship in the Profiler Panel.

Right-click menu - Exploration Canvas

Function Purpose
Select All Selects all nodes on the canvas.
Deselect All Reverses the nodes currently selected.
Invert Selection Highlights all nodes other than those selected
Select Neighbours Will also select neighbouring nodes to Level 1, 2, 3 if they exist
Isolate Useful to clear the Canvas around the node of concern, allowing you to drill-down and investigate just the Neighbors and Relationships that are relevant. Use the 'Shft' key to select multiple nodes, before using 'i'
Clear This will remove a selected node (and its connected Neighbors if present) from the canvas. Useful to de-clutter the Canvas. Use the Shft key and mouse to select multiple nodes for clearing
Group Useful tool to create one or more groups of nodes that can be minimised and expanded on a double-click action. Each Group can be named as it is created.
Explore Neighbors To extend the Neighbors currently displayed for an node.
Explore Relationships To extend the Relationships currently displayed for an node.
Exclude.. Brings up a second menu of Classes available to exclude therefore potentially removing a lot of clutter from the Canvas
Customise Display Use this to select a different icon for this 'specific node'. Useful to highlight an individual node.
Show Annotations Allows you to 'Add' or 'Show'annotations for this specific node. These could include, images, videos or text comments.

Explore Toolbar

The Explore Toolbar at the top of the screen is an easy way to navigate and use Explore. Moving from left to right, icons are responsible for the following;

Action Function Shortcut
Select The first icon in the toolbar, is used to change the mouse pointer for selection of one or more nodes on the Canvas. Used with the left-click option, multiple nodes that fit within a rectangle drawn on the Canvas can be selected. esc or v
Zoom Choose the magnifying glass icon, then click on the Canvas to increase the zoom ‘+’. Click and drag to draw a zoom selection. z
Pan Choose the ‘Pan’ icon, then click and drag your mouse over the Graph to move it around the Canvas. n or hold spacebar
Clear Canvas Use the ‘Clear Canvas’ icon to completely clear the Canvas of everything. e
Redraw Graph Use this at any time to refresh and redraw the Graph on your Canvas. r
Select nodes by Keyword Use this box to search and locate an node by name. Press the Enter key, and it will be color highlighted on the Canvas cmd/ctrl + f
Depth Level Used to choose the appropriate level of complexity as follows; - Level 1 - displays the nearest neighbors only, and is the preferred option to start - Levels 2 & 3 - displays neighbors of neighbors 1, 2 or 3
Toggle node Labels Hides or shows all node names on the Canvas alt + l
Toggle Comments Highlights nodes present that contain at least one annotation with a small red dot. alt + U
Toggle Theme Use this to alternate between light and dark Canvas backgrounds. alt + cmd/ctrl + 1
Toggle Search/Data panel Hide/show panels to the left of the canvas, including Search and Tags. This creates a larger working Canvas alt + i
Toggle Timeline (bottom) Panel Use this to hide/show the Timeline Panel. t
Toggle Profiler (right) Panel Use this to hide/show panels to the right of the Canvas, including Navigator, Profiler and node List. This creates a larger working Canvas alt + cmd/ctrl + 2
Use the ‘Zoom to Fit’ icon (Navigator Panel) to show a group of selected nodes

 

Creating a Saved Graph

Above the toolbar, locate the 'ellipsis menu' to select either the 'Save' or 'Save As...' options.

Other options available from the ellipsis menu;

Function Purpose
New Clear the canvas and begin a new investigation
Open Open an existing Saved Graph
Edit Details Edits details of the Saved Graph
Save Saves any uncommitted changes
Save As... Allows the saving of a duplicate or a modified Graph
Revert Will revert to the previously saved copy of the graph
Clear Canvas Will blank the Canvas (shortcut key ‘e’)
Clear History Clears the History Panel cache. Useful if starting a new project.
Delete Deletes the current Saved Graph.

To retrieve Saved Graphs, Use the 'Saved Graphs' button top right of the screen, to reveal a dashboard similar to that below;

Simply select a Saved Graph with your mouse to immediately add that to the Exploration canvas.

Use the filter options to the left of the screen to narrow down the options.

Use the 'View as List' icon to change the way the Saved Graphs are displayed in the dashboard.

Note: If a 'Clean-up' operation has been performed on the data since the Saved Graph was created, it will be destroyed during this process, and will need to be recreated.

 

Changing the Appearance of Nodes

The easiest and most intuitive method of updating Node icons is direct from the Exploration dashboard.

Within the Tags panel, select the ‘Customize Appearance’ icon representing the Node Category relevant to the icon replacement.

This will open the 'Add Customization' dashboard at the Built-in Icon selection;

Choose an appropriate icon, and then select a suitable Color using the panel on the right.

Select the ‘Save’ button when done, to modify all the icons on the canvas from that Node category.

Repeat this exercise with other Node Categories as required and return to the Exploration dashboard to view the results.

A single specific node can also be represented by a suitable individual icon. But in order to achieve this, use the right-click menu option of ‘Customize Display’ when the node is highlighted on the Exploration canvas.

It is also possible to upload and use your own Icons, provided they have been created in an SVG format. Unfortunately, no other image type is currently supported. Use the 'Uploaded Icons' option from the 'Add Customization' dashboard to achieve this.

Note: Clean-Up operations will not remove icon choices made here, so when Flows are re-run the chosen icons will remain.

 

Adding Annotations to a Node

Annotations in the form of Images, Videos or Text comments can be added to individual nodes to enhance the canvas view. Select any node on the canvas and from the right-click menu, choose the 'Show Annotations' option, or use the shortcut key combination Cmd-M (Cntrl-M on Windows)

This will reveal a pop-up display of current annotations and also offer the ability to add or edit using the '+ Add' button. In the example below an Image and Text annotation has been added. Select from the menu to display each one respectively.

Select the Image or Text or Video to reveal it in full width, or to play the video.

Use the direction arrows to select other annotations that may be present, or use the menu icon to collapse the image and revert back to the menu view.

Use the 'Toggle Comments' toolbar icon (alt-U) to reveal if any nodes have annotations present. This is shown as a small red dot at each corresponding node icon, as shown in the example below.

 

The Profiler Panel

The Profiler Panel to the right of the Exploration canvas will usefully display the Properties of a highlighted node. But there is more detail available if you select the actual node and open the 'View Node Profile'.

This will open at the 'properties' tab;

Switch to the 'relationships' tab, to reveal more detail regarding the node's relationships;

The 'graphs' tab will advise how many Saved Graphs in which this node has been used. Simply select one of the Saved Graphs displayed to open it at the canvas if required.

Select the 'annotations' tab to view or even add an annotation in the form of an Image, Video or Text entry.


 

Admin Menu

Used to enable and configure Gemini Explore apps, group together teams of users, and add new icons that can be used on the Exploration canvas.

Apps Dashboard

The Admin menu opens at the Apps dashboard to show which apps have been installed. Currently, our Splunk Inspect app is installed, but disabled by default.

Use the Slider switch to enable Splunk Inspect and complete the Configuration menu to connect it to a working Splunk Monitoring Console instance, in order to give you a new augmented user experience for observing your Splunk environment.

Refer to the Gemini Enterprise - Splunk Inspect App - Quick start guide for more details.

 

Teams Dashboard

Create Teams to share relevant Saved Graphs amongst Users.

 

Users Dashboard

Create Users to organize Gemini Explore into groups, or Teams, of users that share like-minded graphs.

 

Icons Dashboard

Use the Icons Dashboard to organize icons that appear on the Exploration canvas. Icons can be created or edited by node category (Tag Icons), or by individual node (Node Icons).

New icons can be uploaded provided they are in the .svg format. Currently, no other image type is supported.

 

Keyboard Shortcut keys - Gemini Explore

Use the table below for quick navigation of Explore using your keyboard.

Function Mac OS Windows OS
Deselect All d d
Isolate i i
Select All in Class s s
Inverse Selection w w
Select All cmd + a ctrl + a
node Neighbords L1 1 1
node Neighbords L2 2 2
node Neighbords L3 3 3
Clear Canvas e e
Clear All cmd + e ctrl + e
Redraw Graph r r
Group cmd + g ctrl + g
Ungroup shft + cmd + e shft + ctrl + e
Open Group cmd + o ctrl + o
Close Group cmd + p ctrl + p
Select esc esc
Pan space or n space or n
Zoom z z
Quickfind nodes cmd + f ctrl + f
Maximize Canvas cmd + enter ctrl + enter
Back cmd + z ctrl + z
Undo alt + cmd + z alt + ctrl + z
Redo shift + cmd + z ctrl + y
Zoom In cmd `+` ctrl `+`
Zoom Out cmd - ctrl -
Zoom to All alt + 1 ctrl + 1
Zoom to Selected alt + 2 ctrl + 2
Toggle Animation a a
Toggle node Labels alt + l alt + l
Toggle Timeline t t
Toggle Theme (dark/light) alt + i alt + i
Toggle Graphs/Comments alt + u alt + u
Toggle Search/Data panel alt + cmd + 1 alt + ctrl + 1
Toggle Profiler Panel alt + cmd + 2 alt + ctrl + 2