Relationship Detail Drill-Down ​

List the relationships bundled behind one line on a graph, and open any of them to see what it grants and where it comes from.

Requires role: Viewer (view a relationship), Operator (revoke a relationship through Select Fire)

Related: River Drill-Down, Graph Explorer, Select Fire, Critical Junctions, Detection Alerts, Identity Inventory, Risk Posture Dashboard, Account Security & Credential Hygiene Checks

Overview ​

Most graphs draw one labeled line between two buckets to stand for everything that links them, such as "ACL permission (2)" between two groups. That one line can stand for a single permission or for a dozen, and the label doesn't say which permissions they are.

Select the line to list every relationship behind it in a table. When the relationship type carries permissions, a column names them on every row. Select a row to open that one relationship. It shows the permissions it grants and whether they were set on the object or inherited. It also shows whatever else that kind of relationship holds, such as privileges, sign-ins, a detection alert or a Group Policy grant.

On a page where you're already investigating an identity, the relationship opens inside the identity panel you have open. The header, the tabs and the identity's details stay where they are. Only the body and the buttons change to show the relationship. Step back and you return to what you were reading. In the Graph Explorer, which has no identity panel to anchor to, the relationship opens in its side panel.

It works the same way on every graph that draws a bundled line: Graph Explorer, the Dashboard, Identity Inventory, Security Posture, Critical Junctions, Detection Alerts, Boundary Escape and the Simulate step of Select Fire.

Prerequisites ​

  • Role: Viewer or higher to open the table and a relationship. Operator or higher to revoke a relationship (see Revoking a relationship). Some host pages, such as Security Posture and Critical Junctions, need the Operator role to open at all. The relationship view follows the role that got you there.
  • A finished sync: At least one identity sync has finished, so the graph has relationships to show.
  • No setup: It works everywhere a bundled line appears. There's nothing to turn on.

Opening a relationship table ​

  1. Open a page with a graph, such as the Dashboard, Security Posture, Critical Junctions, Detection Alerts, Identity Inventory or the Simulate step of Select Fire.
  2. Select a labeled line between two buckets, such as "ACL permission (2)" or "Member of (3)".
  3. Read the table of the relationships behind that line.

The number in the label is how many relationships the line stands for. A line that stands for one relationship shows the label alone, and opens that relationship straight away. See Opening a single relationship.

The table's toolbar names the relationship type, then gives the count and the direction, such as "3 relationships · User → Group". Every table has Source, Type, Target and Fidelity columns. The rest depend on the relationship type. See Table columns.

Table columns ​

Which columns a table shows ​

Every table starts with Source, Type and Target. A table shows only the other columns its relationship type can fill, so a Member of table doesn't carry four columns of dashes.

Relationship typeColumns after Source, Type and Target
ACL permission (ACL is short for access control list)Permissions, Fidelity, Severity, Weight, Origin
App role assignmentPermissions, Fidelity, Severity, Weight
PrivilegePrivileges, Fidelity, Severity, Weight
SessionSign-ins, Logon types, Fidelity, Weight
Group Policy controlFidelity, Severity
Owner ofFidelity, Origin
Member of, Contained in, Domain trust, Local administrator, Remote Desktop access and most other typesFidelity

A Member of table shows four columns. An ACL permission table shows all eight. A dash in a cell means that row has no value for the column, for example Origin on a permission that came from Entra ID.

The Columns chooser lists only the columns the relationship type can fill, so a Member of table never offers Permissions or Origin. Within that set, you can show, hide, reorder and resize columns, and Reset to default restores them. The layout is saved for each relationship type. Arranging a Member of table doesn't change an ACL permission table, and each opens the way you left it.

The Permissions column ​

The Permissions column names the permissions on each row, such as "GenericWrite, WriteDacl, WriteOwner". It shows the names on a graph focused on one identity and on the whole-environment overview alike. A long list is cut off at the column's edge. Hover over the cell to see the whole list, one permission per line.

The Origin column ​

Origin says where an Active Directory permission comes from: Set on this object, Delegated from a parent, Default or Unknown.

The Privileges, Sign-ins and Logon types columns ​

In a Privilege table, the Privileges column names the rights each relationship grants on its computer, such as "SeBackupPrivilege, SeDebugPrivilege". Like the Permissions column, it shows every name, with the full list one per line when you hover over the cell.

A Session table has two columns of its own:

  • Sign-ins is how many successful sign-ins GraphnAI has recorded for that account on that computer. Select its header to put the busiest sessions first.
  • Logon types breaks those sign-ins down by how they happened, most frequent first, such as "Remote Interactive (12), Network (3)". A logon type that Windows reports by number only shows as "Unknown type" and the number, such as "Unknown type 12".

An export includes these columns when they're shown, with logon types written as "Remote Interactive: 12; Network: 3".

The toolbar ​

The table's controls sit together at the right of its toolbar, in this order:

  1. Columns shows, hides and reorders the columns this relationship type offers.
  2. Export downloads the rows as CSV or JSON. The file holds only the columns on screen, in the order they appear. Hide a column before you export and the file leaves it out.
  3. Close (the X) closes the table.

Opening a single relationship ​

Select a row to open that relationship. The row stays highlighted, so you can see which one you're reading. Select the highlighted row again to close the relationship.

Selecting a row never takes you to another page. The only way to leave from inside the relationship view is to select the source or target name, described below.

When a line stands for one relationship ​

When a line stands for exactly one relationship, selecting it skips the table and opens the relationship, with "Loading relationship…" while it loads.

Now and then a line that shows one relationship on the graph shares its data with another line of the same type. A blocked relationship drawn apart from an active one is an example. The table opens instead, as it would for a larger line, so you can pick the row you meant.

What a relationship shows ​

The top of the view has a Back link, the relationship type, and the source and target names. Badges show the evidence level (Theoretical, Constrained or Validated), the severity, and states such as Simulated or Dormant.

Below them, a row of figures shows the Weight and, where they apply, the number of permissions, privileges or sign-in events. A privilege relationship that includes a Critical or High privilege carries an Admin equivalent badge.

The sections depend on the kind of relationship:

SectionWhat it shows
Permissions in this grantEvery permission the relationship carries, such as GenericWrite, WriteDacl and WriteOwner
Where these permissions come fromHow many permissions were set on this object and how many were delegated from a parent object
Inherited fromThe parent object an inherited permission flows down from
Constrained by, Blocked byThe constraint that limits or blocks the access, such as a disabled account
Privileges heldThe Windows privileges observed on the computer
Session detailsThe protocols seen, and a chart of sign-ins by logon type
Alert detailsThe detection rule and severity of the alert this relationship is tied to
SDProp statusWhether the object's permissions match the template Active Directory enforces on protected accounts (SDProp, the security descriptor propagator): Matches template or Differs from template
Rights that allow this, Through Group Policy, Blast radius, RemediationFor Group Policy control: the rights that grant the control, the Group Policy Objects and where they're linked, what the source can reach through them, and how to fix it

A relationship with nothing more to show reads "No more details for this relationship."

The source and target names at the top of the view are links. Select either one to go to that identity, the same as selecting it anywhere else. It's the only way the relationship view takes you somewhere else. Opening the table and selecting a row keep you where you are.

Closing the relationship view ​

Each of these returns you to what you were reading, with the relationship table still open below:

  • Select Back in the panel's footer or at the top of the view.
  • Select empty space on the graph.
  • Select a different bucket or line on the graph.
  • Select a different tab in the panel.
  • Focus a different identity.

Closing the whole panel with the X in its header closes everything, including the relationship table.

Revoking a relationship ​

With the Operator role or higher, an open relationship shows Revoke this relationship in place of the panel's usual footer. Select it to open Select Fire for exactly that relationship. The subject, the target and the remove access operation are filled in, and no root-cause analysis runs. This path fixes only what you selected, and leaves everything else the identity is exposed through.

The root-cause plan for the whole identity stays on the identity panel's own Select Fire button, which returns when you select Back.

Viewers don't see Revoke this relationship. The button is hidden for simulated relationships and for one that's no longer present. On a read-only license, it's disabled with the tooltip "Read-only until a valid license is applied. An administrator can apply one on the License page." See Select Fire for the simulation and remediation steps after it opens.

Graph Explorer's relationship panel has no Revoke this relationship button. Its footer offers Show each permission for a permissions relationship, and Select Fire for a Group Policy control relationship.

Where this applies ​

PageNotes
Graph ExplorerOpens in the side panel Graph Explorer uses for selected lines. There's no identity panel to anchor to here.
DashboardBundled lines on a finding's blast radius graph
Security PostureBundled lines on a failing check's graph, inside the remediation panel
Critical JunctionsInbound and outbound lines around a junction
Detection AlertsBundled lines on an alert's graph
Identity InventoryBundled lines on the graph views. The relationship table replaces the identity table while it's open, and the identity table returns unchanged when you close it.
Boundary EscapeBundled lines for an exposed identity
Select Fire (Simulate step)Bundled lines on the blast radius graph, before you choose an execution mode. The footer shows Back only, because Select Fire can't open from inside itself.

Role Requirements Summary ​

ActionRequired role
Open a relationship tableViewer or higher
View a single relationshipViewer or higher
Go to the source or target identityViewer or higher
Revoke a relationship through Select FireOperator or Admin

Troubleshooting ​

Selecting a row doesn't open anything ​

  • Cause: The selection landed beside the row, or the row was already open and the second selection closed it.
  • Fix: Select the row again. If the panel still doesn't change, close the table and select the labeled line again.

A line labeled with one relationship opens a table ​

  • Cause: The line shares its data with another line of the same type, for example a blocked relationship drawn apart from an active one.
  • Fix: Select the row you meant. The relationship opens as it would from any other row.

The view says "This relationship is no longer present." ​

  • Cause: The relationship existed when the table loaded and is gone now. GraphnAI saw it removed, for example by a group membership change, and the next full sync hasn't cleared the row yet.
  • Fix: None needed. The table row may keep the old values until that sync finishes.

The view says "Couldn't load the relationship. Reload to try again." ​

  • Cause: The lookup failed, usually because of a brief network or server problem.
  • Fix: Select Retry in the panel. If it keeps failing, ask an administrator to check that the server is reachable and to read its logs.

Revoke this relationship doesn't appear ​

  • Cause: You have the Viewer role, the relationship is simulated or gone, or you're in Graph Explorer, which has no revoke button.
  • Fix: Open the relationship from a page with an identity panel, with the Operator role. If the button is there but disabled, the license is read-only. Hover over it for the reason.

An expected column isn't in the table or the Columns chooser ​

  • Cause: Each table offers only the columns its relationship type can fill. A Member of relationship carries no permissions, severity, weight or origin, so its table shows Source, Type, Target and Fidelity only.
  • Fix: See Which columns a table shows. Column layouts are saved for each relationship type, so a column you hid or moved on one table is unchanged on the others.