Start your free Preview
ProductHow it worksSee what's realFix it safelyCatch attacksGraphneIntegrationsPlay the graphWeekly puzzlePricing
IndustriesHealthcareFinancial servicesGovernmentEducation
ResourcesDocsDetection catalogPosture check catalogChangelogBlog
CompanyTrustAboutCareersPressContact
Start your free Preview
Docs menu

Relationship Detail Drill-Down

List the edges bundled behind one line on a graph, and open any edge to see its permissions, fidelity level, origin and whether each permission was seen in use.

Roles
Viewer (view an edge), Operator (revoke an edge through Select Fire)
Updated
On this page

Overview

Most graphs draw one labeled edge between two buckets to stand for everything that links them, such as "ACL permission (2)" between two groups. That one line can stand for a single permission or for a dozen, and the label doesn't say which permissions they are.

Select the line to list every edge behind it in a table. When the edge type carries permissions, a column names them on every row. Select a row to open that one edge. It shows the permissions it grants and whether they were set on the object or inherited. It also shows whatever else that kind of edge holds, such as privileges, logons, a detection alert or a Group Policy grant. For Active Directory permissions, each permission also says whether it was seen in use, or that nothing changed through it. See Permission-Use Evidence.

On a page where you're already investigating an identity, the edge opens inside the identity panel you have open. The header, the tabs and the identity's details stay where they are. Only the body and the buttons change to show the edge. Step back and you return to what you were reading. In the Graph Explorer, which has no identity panel to anchor to, the edge opens in its side panel.

It works the same way on every graph that draws a bundled edge: Graph Explorer, the Dashboard, Identity Inventory, Security Posture, Critical Junctions, Detection Alerts, Boundary Escape and the Simulate step of Select Fire.

Prerequisites

  • Role: Viewer or higher to open the table and an edge. Operator or higher to revoke an edge (see Revoking an Edge). Some host pages, such as Security Posture and Critical Junctions, need the Operator role to open at all. The edge detail follows the role that got you there.
  • A finished sync: At least one identity sync has finished, so the graph has edges to show.
  • No setup for the edge table: It works everywhere a bundled edge appears. Permission-use evidence also needs Windows auditing on your domain controllers. See Audit policy for use evidence.

Opening an Edge Table

  1. Open a page with a graph, such as the Dashboard, Security Posture, Critical Junctions, Detection Alerts, Identity Inventory or the Simulate step of Select Fire.
  2. Select a labeled line between two buckets, such as "ACL permission (2)" or "Member of (3)".
  3. Read the table of the edges behind that line.

The number in the label is how many edges the line stands for. A line that stands for one edge shows the label alone, and opens that edge straight away. See Opening a Single Edge.

The table's toolbar names the edge type, then gives the count and the direction, such as "3 edges · User → Group". Every table has Source, Type, Target and Fidelity columns. The rest depend on the edge type. See Table columns.

Table columns

Which columns a table shows

Every table starts with Source, Type and Target. A table shows only the other columns its edge type can fill, so a Member of table doesn't carry four columns of dashes.

Edge type Columns after Source, Type and Target
ACL permission (ACL is short for access control list) Permissions, Fidelity, Severity, Weight, Origin
App role assignment Permissions, Fidelity, Severity, Weight
Privilege Privileges, Fidelity, Severity, Weight
Session Logons, Logon types, Fidelity, Weight
Group Policy control Fidelity, Severity
Owner of Fidelity, Origin
Member of, Contained in, Domain trust, Local administrator, Remote Desktop access and most other types Fidelity

A Member of table shows four columns. An ACL permission table shows all eight. A dash in a cell means that row has no value for the column, for example Origin on a permission that came from Entra ID.

The Columns chooser lists only the columns the edge type can fill, so a Member of table never offers Permissions or Origin. Within that set, you can show, hide, reorder and resize columns, and Reset to default restores them. The layout is saved for each edge type. Arranging a Member of table doesn't change an ACL permission table, and each opens the way you left it.

The Permissions column

The Permissions column names the permissions on each row, such as "GenericWrite, WriteDacl, WriteOwner". It shows the names on a graph focused on one identity and on the whole-environment overview alike. A long list is cut off at the column's edge. Hover over the cell to see the whole list, one permission per line.

The Origin column

Origin says where an Active Directory permission comes from: Set on this object, Delegated from a parent, Default or Unknown.

The Privileges, Logons and Logon types columns

In a Privilege table, the Privileges column names the rights each edge grants on its computer, such as "SeBackupPrivilege, SeDebugPrivilege". Like the Permissions column, it shows every name, with the full list one per line when you hover over the cell.

A Session table has two columns of its own:

  • Logons is how many successful logons (event 4624) GraphnAI has recorded for that account on that computer. Select its header to put the busiest sessions first.
  • Logon types breaks those logons down by how they happened, most frequent first, such as "Remote Interactive (12), Network (3)". A logon type that Windows reports by number only shows as "Unknown type" and the number, such as "Unknown type 12".

An export includes these columns when they're shown, with logon types written as "Remote Interactive: 12; Network: 3".

The toolbar

The table's controls sit together at the right of its toolbar, in this order:

  1. Columns shows, hides and reorders the columns this edge type offers.
  2. Export downloads the rows as CSV or JSON. The file holds only the columns on screen, in the order they appear. Hide a column before you export and the file leaves it out.
  3. Close (the X) closes the table.

Opening a Single Edge

Select a row to open that edge. The row stays highlighted, so you can see which one you're reading. Select the highlighted row again to close the edge.

Selecting a row never takes you to another page. The only way to leave from inside the edge detail is to select the source or target name, described below.

When a line stands for one edge

When a line stands for exactly one edge, selecting it skips the table and opens the edge, with "Loading relationship…" while it loads.

Now and then a line that shows one edge on the graph shares its data with another line of the same type. A blocked edge drawn apart from an active one is an example. The table opens instead, as it would for a larger line, so you can pick the row you meant.

What an Edge Shows

The top of the view has a Back link, the edge type, and the source and target names. Badges show the Tiered Fidelity™ level (Theoretical, Constrained or Validated), the severity, and states such as Simulated or Dormant.

Below them, a row of figures shows the Weight and, where they apply, the number of permissions, privileges or events. A privilege edge that includes a Critical or High privilege carries an Admin equivalent badge.

The sections depend on the kind of edge:

Section What it shows
Permissions in this grant Every permission the edge carries, such as GenericWrite, WriteDacl and WriteOwner, each with whether it was seen in use
ACE origin How many permissions were set on this object (explicit ACEs) and how many were delegated from a parent object (inherited ACEs)
Inherited from The parent object an inherited permission flows down from
Constrained by Each constraint that was evaluated on a Constrained edge, whether it blocks the access or allows it
Blocked by Each constraint that blocks the edge, such as a disabled account, with the note "This access is granted but blocked right now…". A blocked (dormant) edge is drawn dashed, ranks last in pathfinding and still counts.
Privileges held The Windows privileges observed on the computer
Session details The protocols seen, and a chart of logons by logon type
Alert details The detection rule and severity of the alert this edge is tied to
SDProp status Whether the object's permissions match the template Active Directory enforces on protected accounts (SDProp, the security descriptor propagator): Matches template or Divergent ACEs
Enabling rights, Through Group Policy, Blast radius, Remediation For Group Policy control: the rights that grant the control, the Group Policy Objects and where they're linked, what the source can reach through them, and how to fix it

An edge with nothing more to show reads "No more details for this relationship."

Permission-Use Evidence

An ACL permission, Owner of or ReadGMSAPassword edge shows, under each permission, whether it was seen in use. GraphnAI reads Windows Security events from your domain controllers and matches each one to the permission it exercised. It looks back 90 days by default. Use through a group credits the group's grant.

Reading a permission's line

Each permission in the Permissions in this grant section has one line under its name:

Line What it means
Seen in use · 14 October 2026 A matching event shows the permission used within the window. The date is the latest use. Hover over the line to see who used it.
Seen in use by svc-helpdesk · 14 October 2026 A member of the group that holds the grant used it. The hover text names the group.
No changes made with it in 90 days GraphnAI checked the object's change history on every writable domain controller. No value-changing write to the attributes this permission controls happened in the window. See Change-History Checks.
Can't be verified yet GraphnAI can't tell either way. A reason line under it says why. See Why a permission can't be verified yet.
Not checked yet GraphnAI hasn't checked this permission yet. It checks after each sync.

With two or more permissions, a summary bar above the list shows how many are in each state. When every permission was seen in use, the bar gives way to the line "Every permission in this grant was seen in use."

Validated means every permission was seen in use

On these edges, Validated now means that every permission on the edge was seen in use. If you add a permission that nobody has used, the edge drops back to Constrained or Theoretical. The level stays in place through syncs, because GraphnAI keeps the evidence apart from the edge. Validated counts a use whenever it happened, while the line under each permission covers the review window, so a Validated edge can show a permission whose last use was before the window.

The Evidence section's ladder shows the same count on its Validated rung, such as "2 of 3 permissions seen in use". Before any permission has been checked, the rung reads "Use of these permissions hasn't been checked yet."

Which events count as use

GraphnAI reads these Windows Security events. Each credits the permissions that operation falls inside.

Event Use it shows Permissions it credits
4724 A password reset on the account ForceChangePassword, AllExtendedRights, GenericAll
4728, 4732, 4756 (added) and 4729, 4733, 4757 (removed) A change to a group's members AddMember, GenericWrite, GenericAll, and AddSelf when the account added itself
4662 An operation on a directory object, such as a replication request, a property write, WriteDacl or WriteOwner The matching right, including DCSync, GetChanges and GetChangesAll, plus AllExtendedRights, GenericWrite or GenericAll
5136 A directory attribute change, such as servicePrincipalName, msDS-KeyCredentialLink, gPLink or nTSecurityDescriptor The matching right, such as WriteSPN or AddKeyCredentialLink, plus GenericWrite and GenericAll

One operation credits every permission that contains it. A password reset credits ForceChangePassword, AllExtendedRights and GenericAll.

A use by a member of a group credits the group's grant, through up to five levels of nested groups. Everyone and Authenticated Users aren't credited.

GraphnAI doesn't match a read of a gMSA password to an event yet, so a ReadGMSAPassword permission isn't marked seen in use.

Why a permission can't be verified yet

"Can't be verified yet" means GraphnAI has no event that shows the use, and no way yet to prove that it never happened. The reason line says which case applies.

Reason line What to do
Not seen in use in 90 days, but GraphnAI can't prove yet that it went unused. Nothing. GraphnAI can't check this permission's change history yet, so "not seen" never reads as "not used". The hover text adds "Last used" with a date when an older use is on record.
Use of Entra ID permissions isn't checked yet. Nothing. Only Active Directory permissions are checked.
No Windows event shows SID history in use. Nothing. SID history leaves no event of its own.
Use of delegation rights isn't checked yet. Nothing.
Domain controllers, system accounts, built-in groups and SID history aren't tracked. Nothing. A grant held by one of these is never marked seen in use.
The group has more than 5,000 members, too many to check. Nothing.
The group nests more than five levels deep, too deep to check. Flatten the nesting if you need the evidence.
GraphnAI doesn't know how Windows records this permission. Nothing.
This access isn't a permission on the object or a group membership, so its use isn't checked. Nothing.
A value changed recently, so this right may have been used. Nothing. The line names the attribute, the domain controller and when it changed.

Change-History Checks lists the lines a check adds.

Memberships

A Member of edge adds a Permissions this membership gives section. It lists each permission the membership gives, as "ForceChangePassword on Jane Smith", each with its own evidence line. Seen-in-use permissions come first, then those that can't be verified yet. The list shows 50 rows, and Show all lists the rest.

  • A group that gives no permissions reads "This group gives no directory permissions."
  • A membership that gives more than 2,000 permissions reads "This membership gives more than 2,000 permissions, too many to check."

While GraphnAI loads past events

After an upgrade, GraphnAI replays the audit events it already holds, up to 90 days, in the background. Until that finishes, the section says "Still loading past audit events (41 of 90 days). Earlier use may appear as this finishes." Nothing needs your action. The panel is correct while it runs. It only shows less use than it will.

When the check fails

  • If the request fails, the permission names still show, with "Couldn't check whether these permissions were used." and a Retry button.
  • If GraphnAI answers but can't finish, each line reads "Not checked yet", with "Couldn't finish the check." and Retry.

Audit policy for use evidence

Use evidence comes from events your domain controllers write only when auditing is on. Turn on these subcategories on every domain controller the collector reads, as described in Telemetry Pipeline:

Subcategory Setting Events
Account Management > Audit User Account Management Success 4724
Account Management > Audit Security Group Management Success 4728, 4729, 4732, 4733, 4756, 4757
DS Access > Audit Directory Service Access Success 4662
DS Access > Audit Directory Service Changes Success 5136

A permission whose events aren't audited stays at "Can't be verified yet". Events 4662 and 5136 are logged only for objects that carry a matching auditing entry (a SACL).

The source and target names at the top of the view are links. Select either one to go to that identity, the same as selecting it anywhere else. It's the only way the edge detail takes you somewhere else. Opening the table and selecting a row keep you where you are.

Closing the Edge Detail

Each of these returns you to what you were reading, with the edge table still open below:

  • Select Back in the panel's footer or at the top of the view.
  • Select empty space on the graph.
  • Select a different bucket or line on the graph.
  • Select a different tab in the panel.
  • Focus a different identity.

Closing the whole panel with the X in its header closes everything, including the edge table.

Revoking an Edge

With the Operator role or higher, an open edge shows Revoke this relationship in place of the panel's usual footer. Select it to open Select Fire for exactly that edge. The subject, the target and the remove access operation are filled in, and no root-cause analysis runs. This path fixes only what you selected, and leaves everything else the identity is exposed through.

The root-cause plan for the whole identity stays on the identity panel's own Select Fire button, which returns when you select Back.

Viewers don't see Revoke this relationship. The button is hidden for simulated edges and for one that's no longer present. On a read-only license, it's disabled with the tooltip "Read-only until a valid license is applied. An administrator can apply one on the License page." See Select Fire for the simulation and remediation steps after it opens.

Graph Explorer's edge panel has no Revoke this relationship button. Its footer offers Show each permission for a permissions edge, and Select Fire for a Group Policy control edge.

Where this applies

Page Notes
Graph Explorer Opens in the side panel Graph Explorer uses for selected edges. There's no identity panel to anchor to here.
Dashboard Bundled edges on a finding's blast radius graph
Security Posture Bundled edges on a failing check's graph, inside the remediation panel
Critical Junctions Inbound and outbound edges around a junction
Detection Alerts Bundled edges on an alert's graph
Identity Inventory Bundled edges on the graph views. The edge table replaces the identity table while it's open, and the identity table returns unchanged when you close it.
Boundary Escape Bundled edges for an exposed identity
Select Fire (Simulate step) Bundled edges on the blast radius graph, before you choose an execution mode. The footer shows Back only, because Select Fire can't open from inside itself.

Role Requirements Summary

Action Required role
Open an edge table Viewer or higher
View a single edge Viewer or higher
Go to the source or target identity Viewer or higher
Revoke an edge through Select Fire Operator or Admin

Configuration

An administrator can change how far back the panel looks. Ask your GraphnAI deployment team to set the use-evidence display window to a duration from 1 hour to 365 days, such as 30 days. The default is 90 days. A value outside the range is moved to the nearest limit, and an unreadable value is ignored.

The window changes only what the panel shows as "Seen in use". Automatic removal decisions never read it.

Troubleshooting

Selecting a row doesn't open anything

  • Cause: The selection landed beside the row, or the row was already open and the second selection closed it.
  • Fix: Select the row again. If the panel still doesn't change, close the table and select the labeled line again.

A line labeled with one edge opens a table

  • Cause: The line shares its data with another line of the same type, for example a blocked edge drawn apart from an active one.
  • Fix: Select the row you meant. The edge opens as it would from any other row.

The view says "This relationship is no longer present."

  • Cause: The edge existed when the table loaded and is gone now. GraphnAI saw it removed, for example by a group membership change, and the next full sync hasn't cleared the row yet.
  • Fix: None needed. The table row may keep the old values until that sync finishes.

The view says "Couldn't load the relationship. Reload to try again."

  • Cause: The lookup failed, usually because of a brief network or server problem.
  • Fix: Select Retry in the panel. If it keeps failing, ask an administrator to check that the server is reachable and to read its logs.

Revoke this relationship doesn't appear

  • Cause: You have the Viewer role, the edge is simulated or gone, or you're in Graph Explorer, which has no revoke button.
  • Fix: Open the edge from a page with an identity panel, with the Operator role. If the button is there but disabled, the license is read-only. Hover over it for the reason.

Every permission reads "Can't be verified yet"

  • Cause: GraphnAI has no event that shows the permissions used. Auditing may be off on the domain controllers the collector reads, or nobody has used them.
  • Fix: Turn on the subcategories in Audit policy for use evidence. Make sure the Telemetry Pipeline is collecting from those domain controllers.

A permission used recently isn't marked "Seen in use"

  • Cause: The event isn't audited, falls outside the window, or GraphnAI is still loading past audit events after an upgrade.
  • Fix: Check the audit policy. If the section shows "Still loading past audit events", wait for it to finish.

The edge is Theoretical or Constrained though some permissions were used

  • Cause: Validated needs every permission on the edge seen in use. One unused or unverifiable permission holds the whole edge back.
  • Fix: Read the Evidence ladder. Its Validated rung shows how many permissions were seen in use.

An expected column isn't in the table or the Columns chooser

  • Cause: Each table offers only the columns its edge type can fill. A Member of edge carries no permissions, severity, weight or origin, so its table shows Source, Type, Target and Fidelity only.
  • Fix: See Which columns a table shows. Column layouts are saved for each edge type, so a column you hid or moved on one table is unchanged on the others.

    ↑↓ to move, Enter to open