Host, IP, and user graphs for live threat context
Map connections as they happen. Flag a compromised node and let neighbor exposure update immediately — then query novelty on the next anomalous connection.
Entities that usually belong in the graph
- Hosts / workloads — servers, VMs, pods
- IP addresses — source, destination, NAT
- Users and identities — who initiated the session
- Devices — laptops, agents, MFA tokens when you have them
- Services — named endpoints the host graph talks to
Questions JetGraph is built to answer quickly
- Is this host→IP or user→host edge new (novelty)?
- What is the connection velocity from this identity or host in the last hour?
- If this host is flagged compromised, which neighbors now show exposure (propagation)?
- How many distinct peers has this IP talked to (HyperLogLog cardinality)?
- What 1-hop neighborhood should an analyst or SOAR playbook pull without a warehouse query?
Lateral movement
Lateral movement is a path problem. JetGraph is strongest at short, hot paths: new connections from a flagged host, sudden velocity, shared credentials/devices as edges. Deep historical ATT&CK reconstructions over months of NetFlow still belong in a SIEM or investigative graph. Use JetGraph for the live “is this hop weird now?” layer.
Anomalous connections
Combine novelty (never seen this host pair), velocity (burst of new peers), and cardinality (IP talking to too many distinct hosts) with neighbor risk after a detected compromise. Same three-phase loop as risk scoring: query → decide (allow, isolate, step-up) → write the connection edge → flag if needed.