General Overview of Gemini Explore

Gemini Explore forms part of our Gemini Enterprise offering and has been specifically designed from the ground up to offer a rich visual experience in which to explore and investigate your data

Using this dynamic multi-layer visualization tool technology, the user is able to drill-down and interact with data. For instance, double-click a User node and discover to which servers and personnel they are connected.

This process is intuitive to use, as it mimics the way our brains ‘think’. When we discover something interesting, we instinctively need to know how this occurred or to what it is connected. Using Explore, we can simply 'click' a node on the canvas to discover its context and reveal more information.

Data Modeling Dashboard

Gemini Explore has a Data Modeling dashboard built-in, used to create the Sources, Models, Commands and Flows required under the hood, as described in detail within our Gemini Explore - User Guide.

Also available is the 'Art of Data Modeling' document that focuses specifically on model creation, using a series of use cases and examples. Both are available as PDF downloads from many of our recent Support Portal documents.

The current document assumes that the underlying model components have already been created and specifically refers to how a user interacts with the Exploration dashboard and its associated canvas.

The Exploration Dashboard

This is where your visual investigation journey begins. To start the process you may have a use-case in mind, such as a User or Host that you wish to investigate.

For example, search for a relevant node category from the Tags panel, and to narrow down the search, it may be necessary to show or exclude nodes using the search panel, where a node can be any discernible ‘thing’ that exists on your Graph.

The example here shows nodes from a Movie database making up the view on the Canvas

In the left-hand margin, Explore has two panels; a Search Panel used to filter results, and a Tags Panel used to manage the Node categories that have been made available by the underlying Models.

On the right, the Navigator helps to contain the view of multiple nodes on the canvas, and the Profiler gives a greater insight into the Properties and relationships of a selected node.

A Toolbar runs along the top of the screen, and these all surround a central Canvas.

Search and Tags Panels

The ‘Show’ entry box will be the usual way of driving investigations across your data. This will restrict implicit chosen nodes within their Node Categories, linked by a logical ‘OR’. For instance just Movie or Director.

To add Node Categories, locate and highlight them from the Tags Panel. Then use the ‘+’ icon adjacent to the node name to add to the search criteria.

The Exclude search box will apply a logical ‘NOT’ for selected nodes. This is not as efficient as the previous ‘Show’ option, as it will bring back all nodes except those stated.

To reset your search criteria at any time, click the Reset button.

Working with the Exploration Canvas

There are several ways to work with the Canvas; a combination of shortcut keys, mouse or trackpad, and the upper Toolbar.

Before we start to examine navigation techniques available, here are some general terms to which we will be referring.

General terms used with Explore

Navigating the Exporation Canvas

There are several options available to navigate the canvas.

• Keyboard & mouse controls (including shortcut keys)
• Right-click Menu
• Explore Toolbar

As a simple example of this, a common requirement is to clear the Canvas completely, use either of the bulleted options to achieve the task:

Clearing the Canvas

• Click anywhere on the Canvas and type ‘e’
• Locate and click the ‘Clear Canvas’ icon on the Explore Toolbar
• Open the 'ellipsis' menu, and choose 'Clear Canvas'

You will quickly develop your own preferences when using the product, so we shall now explore some more navigation actions.

Manipulating the Graph

• Hold the space key down on your keyboard, while you click-and-drag your mouse (or trackpad) on the Graph display.
• Locate the Navigator Panel. Click and drag your mouse within this panel to highlight the area of canvas you wish to select.
• Locate the Toolbar and choose the ‘Pan’ (hand) icon. Then click-and-drag your mouse over the canvas
• Hold the 'alt' key together with '1', to create the maximum zoom for all observed nodes on the canvas

Zoom control of the Graph

• Click anywhere on the Canvas and type ‘z’. Click the mouse again to zoom by increments.
• Locate the Navigator Panel, and click the ‘Zoom to fit all’, or the 'Zoom to Fit Selected' icons.
• Locate the Explore Toolbar and choose the ‘+’ magnifying glass icon. Then click on the Graph to increase the zoom.

Selecting Nodes on the Graph

• Select one of the Nodes with your mouse (you may first need to choose the mouse Select Pointer from the Explore Toolbar). The selected Node will be color highlighted.
• Observe the Node List Panel, and search for an individual node using the Search Show box. Select the 'Search' button to run the search and add it to the canvas.
• Locate the Explore Toolbar and search for a Node using the, ‘Select nodes by Keyword’ box.

Working with a group of nodes

• Using your mouse, click-and-drag a selection rectangle around several nodes or hold down the 'SHFT' key and select individual nodes. The selected nodes will be color highlighted.
• 'Right-click' the canvas to reveal various options. In the example below 4 nodes have been selected

• Select or Press 'i' - To isolate those selected nodes
• Select or press 'W' - To Discard these and leave the remaining nodes
• Select or press Cmd/Ctrl 'G' - To create a Group that can be minimized and expanded
• Select 'Save Selection' - To initiate this as a 'Saved Graph'

Using your mouse controls to select and group together nodes is usually the fastest way to navigate, but it takes some practice. See below for a guide as to what can be achieved.

Working with Relationships

Relationships between the nodes, shown graphically as lines, might form your initial use case for an investigation. For instance, if you were looking for current ‘authenticated connections’

• From the Tags Panel, change the selector to ‘Relationships’. Locate a Node Category involving authentications. If it has a number in brackets, this will be the total number it knows about. Use the small ‘+’ icon to add this to your Search box, and known relationships and their corresponding nodes will appear on the Canvas.

To extend the Relationships currently displayed for a node.

• Select the required node, and right-click to choose ‘Explore Relationships…’. This will expand a list of possible relationship types such as a Group or Parent.

To discover more about the Relationship, in other words, the date and time of the authentication, and the status of that authentication.

• Select the connecting line between nodes. Review information about this Relationship in the Profiler Panel.

Right-click menu - Exploration Canvas

Explore Toolbar

The Explore Toolbar at the top of the screen is an easy way to navigate and use Explore. Moving from left to right, icons are responsible for the following;

Creating a Saved Graph

Above the toolbar, locate the 'ellipsis menu' to select either the 'Save' or 'Save As...' options.

Other options available from the ellipsis menu;

To retrieve Saved Graphs, Use the 'Saved Graphs' button top right of the screen, to reveal a dashboard similar to that below;

Simply select a Saved Graph with your mouse to immediately add that to the Exploration canvas.

Use the filter options to the left of the screen to narrow down the options.

Use the 'View as List' icon to change the way the Saved Graphs are displayed in the dashboard.

Changing the Appearance of Nodes

The easiest and most intuitive method of updating Node icons is direct from the Exploration dashboard.

Within the Tags panel, select the ‘Customize Appearance’ icon representing the Node Category relevant to the icon replacement.

This will open the 'Add Customization' dashboard at the Built-in Icon selection;

Choose an appropriate icon, and then select a suitable Color using the panel on the right.

Select the ‘Save’ button when done, to modify all the icons on the canvas from that Node category.

Repeat this exercise with other Node Categories as required and return to the Exploration dashboard to view the results.

A single specific node can also be represented by a suitable individual icon. But in order to achieve this, use the right-click menu option of ‘Customize Display’ when the node is highlighted on the Exploration canvas.

It is also possible to upload and use your own Icons, provided they have been created in an SVG format. Unfortunately, no other image type is currently supported. Use the 'Uploaded Icons' option from the 'Add Customization' dashboard to achieve this.

Adding Annotations to a Node

Annotations in the form of Images, Videos or Text comments can be added to individual nodes to enhance the canvas view. Select any node on the canvas and from the right-click menu, choose the 'Show Annotations' option, or use the shortcut key combination Cmd-M (Cntrl-M on Windows)

This will reveal a pop-up display of current annotations and also offer the ability to add or edit using the '+ Add' button. In the example below an Image and Text annotation has been added. Select from the menu to display each one respectively.

Select the Image or Text or Video to reveal it in full width, or to play the video.

Use the direction arrows to select other annotations that may be present, or use the menu icon to collapse the image and revert back to the menu view.

Use the 'Toggle Comments' toolbar icon (alt-U) to reveal if any nodes have annotations present. This is shown as a small red dot at each corresponding node icon, as shown in the example below.

The Profiler Panel

The Profiler Panel to the right of the Exploration canvas will usefully display the Properties of a highlighted node. But there is more detail available if you select the actual node and open the 'View Node Profile'.

This will open at the 'properties' tab;

Switch to the 'relationships' tab, to reveal more detail regarding the node's relationships;

The 'graphs' tab will advise how many Saved Graphs in which this node has been used. Simply select one of the Saved Graphs displayed to open it at the canvas if required.

Select the 'annotations' tab to view or even add an annotation in the form of an Image, Video or Text entry.

Admin Menu

Used to enable and configure Gemini Explore apps, group together teams of users, and add new icons that can be used on the Exploration canvas.

Apps Dashboard

The Admin menu opens at the Apps dashboard to show which apps have been installed. Currently, our Splunk Inspect app is installed, but disabled by default.

Use the Slider switch to enable Splunk Inspect and complete the Configuration menu to connect it to a working Splunk Monitoring Console instance, in order to give you a new augmented user experience for observing your Splunk environment.

Refer to the Gemini Enterprise - Splunk Inspect App - Quick start guide for more details.

Teams Dashboard

Create Teams to share relevant Saved Graphs amongst Users.

Users Dashboard

Create Users to organize Gemini Explore into groups, or Teams, of users that share like-minded graphs.

Icons Dashboard

Use the Icons Dashboard to organize icons that appear on the Exploration canvas. Icons can be created or edited by node category (Tag Icons), or by individual node (Node Icons).

New icons can be uploaded provided they are in the .svg format. Currently, no other image type is supported.

Keyboard Shortcut keys - Gemini Explore

Use the table below for quick navigation of Explore using your keyboard.