Graph Explorer
The Graph Explorer is a force-directed visualisation of the Babel knowledge graph. It lets you explore relationships interactively — starting from any entity and expanding outward to see its connections.
Node types
The graph uses color-coded nodes for each entity type:
- Actor (blue)
- Cluster (teal)
- Campaign (orange)
- Tool (red)
- Indicator (cyan)
- TTP (purple)
- CVE (light orange)
- Report (amber)
Navigation
| Action | Result |
|---|---|
| Click a node | Select it and highlight its direct connections |
| Double-click a node | Re-centre the graph on that node (on a grouped set of indicators, expand the group) |
| Scroll / pinch | Zoom in and out |
| Drag the canvas | Pan the view |
| Drag a node | Reposition it — the layout adapts around it |
| Use the search bar | Find a specific entity and centre the graph on it |
| Filter by type | Show or hide nodes by entity type |
Entity-focused graphs
Every actor, cluster, campaign, tool, TTP, and CVE detail page has a Graph button that opens the graph pre-filtered to that entity's immediate neighbourhood — its tools, TTPs, indicators, and related actors. Very large neighbourhoods are capped at about 300 nodes; the entity itself and its direct links to actors, clusters, campaigns, tools and TTPs are always kept. This is the fastest way to understand a specific threat group's infrastructure and behaviour.
TIP
Entity graphs are accessible at /graph/actor/<id>, /graph/cluster/<id>, etc. These URLs are shareable and bookmarkable.