VirusTotal Graph nodes

Each node in the graph represents an entity. There are 5 basic entity types:

Files. Represented as a rectangular shape with a representation of the file inside.

Domains. Represented using the domain favicon, if available.

Urls. Represented using the icon below.

IP Addresses. Represented using the flag for its country. If we can’t detect the country from which the IP address is from, we’ll represent it as a black rectangle.

Relationship nodes. Represented with a circle containing a representative icon inside.

The example below is a connection of contacted ip between hash abcde1234 and ip address 1.1.1.1

More than one ip address was related to abcde1234 file.

 

ADVANCED NODE TYPES

In addition to the entity node types, VT Graph also offers these some advanced node types you can use to enrich your investigation with:

•  Actor
•  Department
•  Email
•  Victim
•  Device
•  Port
•  Service
•  SSL Cert
•  Wallet

These nodes are only available for customers with the Private Graph add on. Contact our team if you are interested in our premium features, here.

 

COLOR CODING OF NODES AND EDGES

VT Graph use color coding to represent extra information about nodes and their connections.

VirusTotal contains verdicts for files and urls. Graph represents files and urls that have 1 or more detections using red icons. Otherwise, the color black is used.

• 0 detections
•    1+ detections
•  selected
•  can be expanded

Nodes that have not been expanded yet are represented with a black circle in top right corner. Double clicking on unexpanded nodes will automatically trigger an auto-expansion on that node.

Selected nodes are represented using blue circle. The edges of their direct connections are also represented in blue.

VT Graph uses a kind of node to represent relationships. Arrow edges are used to represent the direction of the relationship.

 

ACTIONS

After a node or relationship is selected, different actions can be performed. Furthermore, bulk actions can be performed over multiple nodes when selected.

 

NODE

Once a node is selected, the left panel will show the relevant information related to it. From there, you will be able to expand relationships, find detection verdicts, comments, etc.

There are actions that can be performed over the selected node. Doing right click over a node will show a contextual menu with the same actions that can be performed from the left panel.

 Edit label

Allows to edit the node label. To delete the label, just leave it empty. By default, the initial will be labeled with the file name if we have it, “Root node” otherwise. For urls, domains and ip, we’ll use the display value as label.

 Add new node

Opens the panel which guides you to add a new connected node to the selected node. Links connecting nodes that have been manually added are represented with a dotted line.

 Center node

Center the node in the screen

 Pin node / Remove pin

Removes the animation or gravity from the graph. By default, the nodes can be dragged but they'll return to a stable graph representation after the click.

When we pin the node, it will stick to the position where we drag it. If we want the node to recover their default behaviour we can "remove pin" from the node.

 Highlight

Big graphs contains a lot of nodes and edges and they are complicated to understand. To help with this problem we can highlight a node, this will hide the nodes that are not directly connected to the highlighted node. You can remove the highlight by clicking somewhere else in the graph.

 Select children

Select the list of nodes that are children of the selected node

 Select parents

Select the list of nodes that are parents of the selected node

 Delete

Deletes the selected nodes and its edges. 

 Full expansion

Expands by all the available expansions for the selected node. It performs the same action as clicking individually in each expansion in the expansion section. By default the first node in the investigation will be expanded using all their available expansions.

 Open public report

Opens the VirusTotal public report for the selected node.

 

RELATIONSHIP NODE

Relationship nodes are special as they are represented as a single node that group other nodes. Because that, it merges actions from both single and multiple node selection.

  Edit label

Allows to edit the node label. To delete the label, just leave it empty. By default, the initial will be labeled with the file name if we have it, “Root node” otherwise. For urls, domains and ip, we’ll use the display value as label.

 Add connected node

Opens the panel which guides you to add a new connected node to the selected node. Links connecting nodes that have been manually added are represented with a dotted line.

 Center node

Center the node in the screen

 Pin node / Unpin node

Removes the animation or gravity from the graph. By default, the nodes can be dragged but they'll return to a stable graph representation after the click.

When we pin the node, it will stick to the position where we drag it. If we want the node to recover their default behaviour we can "remove pin" from the node.

 

 Download CSV

Opens a menu with all the entity ids grouped by the selected relationship node.

 Select children

Select the list of nodes that are children of the selected node

 Select parents

Select the list of nodes that are parents of the selected node

 Align children vertically

Align the children of the relationship node vertically

 Align children horizontally

Align the children of the relationship node horizontally

 Delete

Deletes the selected nodes and its edges. 

 Calculate commonalities

Find common features and patterns for the children nodes of the relationship node. The results will be shown in the left panel. More info related to that process below.

 

 

MULTIPLE NODE SELECTION

Multiple nodes can be selected at the same time. There are two ways to select multiple nodes.

The first one is doing click at the same time you press the shift key on your keyboard. The left panel will be updated with the information related to the selection.

You can also select multiple nodes by pressing shift and click-dragging in the canvas. The same way you are used to select multiple files in any operating system.

These are the actions available:

 Edit label

Allows to edit the node label. To delete the label, just leave it empty. By default, the initial will be labeled with the file name if we have it, “Root node” otherwise. For urls, domains and ip, we’ll use the display value as label.

 Pin node / Remove pin

Removes the animation or gravity from the graph. By default, the nodes can be dragged but they'll return to a stable graph representation after the click.

When we pin the node, it will stick to the position where we drag it. If we want the node to recover their default behaviour we can "remove pin" from the node.

 Center

Center the selected nodes in the screen

 Download CSV

Opens a menu with all the entity ids for the nodes selected.

 

  Align vertically

Align the selected nodes vertically

 Align horizontally

Align the selected nodes horizontally

 Delete

Deletes the selected nodes and its edges. 

 Full expansion

Expands by all the available expansions for one of the selected nodes. It performs the same action as clicking individually in each expansion in the expansion section. By default the first node in the investigation will be expanded using all their available expansions.

 Calculate commonalities

Find common features and patterns for the selected nodes. The results will be shown in the left panel. More info related to that process below.

 

SUBMISSIONS

The submission box gives you a graphical representation of the submissions made for the selected file, grouped by country or by upload date.