Understanding investigation canvas actions

  • Release version: Xanadu
  • Updated November 5, 2024
  • 2 minutes to read
    • Summarize
    Summarized using AI
    This content was generated using new OpenAI-powered functionality. Results are provided on an as is basis and are not guaranteed to be accurate or complete.

    Summary of Understanding Investigation Canvas Actions

    The investigation canvas allows users to perform various actions to manage and analyze data effectively. It includes form, graph, node, edge, and map actions that facilitate linking cases, managing nodes, and visualizing relationships in a structured manner.

    Show full answer Show less

    Key Features

    • Form Actions:
      • Link Case: Connects cases on the canvas.
      • Unlink Case: Disconnects cases on the canvas.
      • Duplicate: Creates copies of nodes on the canvas.
    • Graph Actions:
      • Save Canvas: Saves the current state of the investigation canvas.
      • Add Data to Library: Establishes new relationships between different nodes.
      • Add From Library: Integrates new relationships and threat entities from the threat intelligence library.
      • Add From Case Artifacts: Incorporates data from linked case artifacts.
    • Node Actions:
      • Mark as Home Node: Designates a specific node as the home node.
      • Add Relationship: Creates various relationships among nodes.
      • Show Details: Displays details for a selected node.
      • Open Record: Opens the node's record in a new tab.
      • Remove from Canvas: Deletes the node from the canvas.
      • Fetch Related Records: Retrieves related records for the node.
    • Edge Actions:
      • Edit: Modifies links between cases.
      • Remove: Deletes links between cases.
    • Map Actions:
      • Zoom In/Out: Adjusts the view of the canvas for better focus.
      • Fit to Screen: Resizes the canvas to fit the screen.
      • Export Map: Exports the canvas as a PDF.
      • Refresh: Updates the canvas data.
      • Switch Layouts: Changes the view to either unified vertical or unified force layout for improved clarity and visualization.

    Key Outcomes

    By utilizing these actions, ServiceNow customers can enhance their investigative capabilities, manage complex relationships between data effectively, and improve overall analysis and visualization on the investigation canvas.

    This section describes the various actions that you can perform on the investigation canvas.

    Investigation canvas includes:
    1. Form actions
    2. Graph actions
    3. Node actions
    4. Edge actions
    5. Map actions
    Figure 1. Investigation Canvas
    TISC Investigation canvas view.
    Table 1. Investigation canvas Form actions
    Action Operation
    Link Case Allows to link cases on the investigation canvas.
    Unlink Case Allows you to unlink the cases on the investigation canvas.
    Duplicate Option to duplicate the nodes on the investigation canvas.
    Table 2. Investigation canvas Graph actions
    Action Operation
    Save Canvas Allows you to save the investigation canvas.
    Add Data to Library Allows you to create new relationship between two different nodes.
    Add From Library Creates new relationships and threat entities in the threat intelligence library if the newly added nodes and edges in the canvas are not already part of the library.
    Add From Case Artifacts Allows you to add data from corresponding case artifacts that is linked to the canvas.
    Table 3. Investigation canvas Node actions
    Action Operation
    Mark as Home Node Option to mark that specific node as a home node.
    Add Relationship Option that allows you to add various object relationships. You can add one to many or many to one or many to many node relationships.
    Show Details Option that shows details of that specific node.
    Open Record Option that allows you to open the record in a new tab.
    Remove from Canvas Option that allows you to remove the node from the canvas.
    Fetch Related Records Option that allows you to fetch the related records for that specific node.
    Table 4. Investigation canvas Edge actions
    Action Operation
    Edit Allows to link cases on the investigation canvas.
    Remove Allows you to unlink the cases on the investigation canvas.
    Table 5. Investigation canvas Map actions
    Action Operation
    Zoom in Option to zoom in the investigation canvas to easily focus on specific areas of the canvas.
    Zoom out Option to zoom out the investigation canvas to easily focus on specific areas of the canvas.
    Fit to screen Option to fit the investigation canvas to the screen size.
    Export map Option to export the investigation canvas as a PDF for better viewing.
    Refresh Option to refresh the investigation canvas data.
    Switch to unified vertical layout Option to switch the investigation canvas view to unified vertical layout to enhance the clarity between the nodes.
    Switch to unified force layout Option to switch the investigation canvas view to unified force layout to enhance the visualization of complex relationships between the nodes.