Streaming River Rendering and Exact Counts
Reach graphs load level by level and show the exact number of identities at every level: the Graph Explorer river view, blast radius and permission graphs, Select Fire simulations and junction flow.
Requires role: Viewer (Graph Explorer), Operator (the other pages) Related: Graph Explorer, At-Scale Reads, Select Fire, Critical Junctions, Identity Inventory
Overview
Every graph that shows what an identity can reach, or what can reach it, is built the same way. It does two things:
- It draws as it goes. The first level around the identity appears within a few seconds. Each deeper level joins the graph as soon as it's counted, so you never wait on a blank canvas.
- Its counts are exact. Each level's count is the number of distinct identities whose shortest path from the identity you're viewing is that many levels long. It matches the table you get when you select that level's bucket.
Exact counts matter most where a number drives a decision. On a Select Fire blast radius, an undercount would make a revoke look safer than it is. The graph either shows the real number or says plainly that the number is partial. It never shows part of the map as if it were all of it.
There's nothing to turn on. Every reach graph in the product works this way.
Prerequisites
- Role: The role the page needs. Graph Explorer needs Viewer. The other pages need Operator. See Where This Applies.
- Data: At least one identity sync has finished.
- No configuration: There's no setting or preference for this. See Configuration Options.
What You'll See
Levels appear as they're counted
Open a reach graph, for example by focusing an identity in Graph Explorer or by opening a finding's blast radius. The first level appears within a few seconds. Deeper levels join the graph one by one as each is counted. You don't need to refresh or reopen the view.
While a level with a large number of identities is being counted, a line with a progress bar appears at the top of the graph, for example:
Mapping access, level 2 of 4: 250,000 of 501,459 identities
It shows the count is moving, and it goes away when the level is done. Graph Explorer, blast radius graphs and permission graphs show it.
Nodes may shift while later levels join, and settle once loading is done. If you need a still image for a report or a ticket, wait for the progress line to go away first.
Counts match the drill-down
Where you can select a level's bucket to list its identities, the table's count always matches the count on the graph. See River Drill-Down.
Partial and complete notices
These lines appear at the top of the graph only when something about the map is incomplete, or when it reached a whole boundary. An ordinary identity in an ordinary environment shows none of them.
| Message | What it means |
|---|---|
| "Counts cover 1,000,000 of 1,431,207 identities at this level. Deeper levels are partial." | The identity's reach at that level passed the size limit. The count covers the identities processed up to the limit. Deeper levels are built from that part only. |
| "Mapped 812,000 identities before the time limit. Deeper levels weren't expanded." | Mapping hit its time limit. The levels shown are right, and deeper levels weren't mapped. |
| "Loading stopped early, so the map is incomplete. Reload to try again." | The connection ended before the map finished, with no error, for example after a network drop or a reload. |
| "Couldn't load everything this identity can reach, so the map is incomplete. Reload to try again." | Loading failed partway. The levels already drawn stay on screen. |
| "Reaches all 912,808 identities in its security boundary." | Not a warning. The identity reaches nearly every identity in the directory, so mapping stopped there. The rest sit in forests or tenants it has no path into. The map is complete. |
IMPORTANT
On a Select Fire simulation, the first four messages mean the blast radius on screen isn't the whole picture. Don't decide on a revoke from a partial blast radius. Narrow the view first (see Troubleshooting), or investigate the identity directly.
Where This Applies
| Page | Role | Notes |
|---|---|---|
| Graph Explorer | Viewer | The river view, when you focus an identity. Five levels. |
| Blast radius graphs | Operator | On the Dashboard, Security Posture, Detection Alerts, Critical Junctions, Boundary Escape and Identity Inventory. Four levels. |
| Permission graphs | Operator | On the Dashboard and Identity Inventory. While levels are still loading, the graph shows a loading state instead of "No permission paths found for this identity." |
| Select Fire, Simulate step | Operator | What can reach the subject, before you choose an execution mode |
| Select Fire, simulation graph | Operator | Each target's reach loads on its own |
| Critical Junctions, junction flow | Operator | The flow into the junction and the flow out to its target load on their own. Three levels each way. |
Configuration Options
There's nothing to configure. No setting or preference changes this behavior. An administrator of a very large environment can tune a few server settings, such as the size limit and the time limit. See At-Scale Reads. They change server efficiency and when the partial notices appear. They don't change what an ordinary reach graph looks like.
Troubleshooting
The graph keeps moving while it loads
- Cause: Nodes join the graph as each level is counted, and the layout settles when loading is done.
- Fix: Wait for the progress line to go away before you take a screenshot or read the layout as final.
"Counts cover … Deeper levels are partial."
- Cause: The identity's reach at that level passed the size limit.
- Fix: Narrow the view. In Graph Explorer's river view, select one direction in the toolbar: Outbound: what this object can reach or Inbound: what can reach this object. For a Select Fire decision, investigate the identity by hand before you revoke its access. Don't act on a partial blast radius.
"Mapped … before the time limit."
- Cause: Mapping took longer than the time limit.
- Fix: Narrow the direction as above, then reload. If it happens often on large identities, an administrator can raise the time limit. See At-Scale Reads.
"Loading stopped early, so the map is incomplete."
- Cause: The connection ended before the map finished, usually after a network drop or a reload.
- Fix: Reload the view. Don't treat what's on screen as complete, and don't base a revoke on it.
"Couldn't load everything this identity can reach, so the map is incomplete."
- Cause: Loading failed partway.
- Fix: Reload the view. If it fails every time on the same identity, ask an administrator to check the server logs and the stream settings. See At-Scale Reads.
A count is higher than in an older report
- Cause: Older versions sampled large reaches at level 2 and deeper, and showed the sample as if it were the total. A group of about 500,000 members could read as about 9,000.
- Fix: None needed. The current count is exact, and it matches the level's drill-down table.
The first level takes more than a few seconds
- Cause: The first level usually appears in under five seconds. When it's always slower, the relationships may be missing fields that the fast path needs.
- Fix: Confirm a full sync has finished since the last upgrade. See At-Scale Reads.
Related Documentation
- Graph Explorer: the river view of an identity in focus
- At-Scale Reads: the streaming protocol, cursors and the reset procedure the streaming path depends on
- Select Fire: where an exact blast radius matters most
- Critical Junctions: junction flow graphs, which stream
- Identity Inventory: graph views and permission graphs, which stream