<p><img src="https://media.daily.dev/image/upload/s--7dr2WYPm--/f_auto/v1729771118/ugc/content_289b8879-2b91-4c6f-af5e-e3f1adcd5e3c" alt="forensics-production"></p>
<h2>Recently I was asked to build a 3D Knowledge Graph for endpoint forensics purposes.</h2>
<p>The results were impressive, but I find it challenging to organize the endpoints in a way that makes it easy to understand in 3D. The complexity often leads to confusion for users.</p>
<h2>Does anyone have insights or ideas on clearer presentation methods?</h2>
<p>There probably is some techniques used in RTS games that could help.</p>
<p><strong>Could isometric griding or other techniques help?</strong></p>
<h1>I’d love to hear your thoughts!</h1>
<p>Full Length Video
<a href="https://www.linkedin.com/feed/update/urn:li:activity:7201975652072251392/" target="_blank" rel="noopener nofollow">https://www.linkedin.com/feed/update/urn:li:activity:7201975652072251392/</a></p>

Whether you are developing for defenders, penetration testers, or anything in between we want to hear about it! We welcome detection engineers, vulnerability researchers, tool developers, and anyone interested in being a dev in cyber.

Cyber Devs

Building a 3D Knowledge Graph for endpoint forensics can yield impressive results but organizing the endpoints clearly is challenging. Suggestions for clearer presentation methods, potentially using RTS game techniques or isometric gridding, are being sought.

D3 / ThreeJS Network Topology Simulation

<p>Initial thoughts:</p>
<ul>
<li>WHOA…I love it.  Does it work in XR 🧐</li>
<li>DAG: use a varying distance from the router/gateway to switch between ping times, geo/office location, last heartbeat, or severity (farther away == more CVEs)</li>
<li>Adding bloom to the spheres could represent danger level (CVE-based) and the distance between them is a relative representation of ping times or geo</li>
<li>Add “waypoint saving” that maintains a “pin” (set in the popup when clicking on a node), that is then visible as a 2D marker at any distance for “route planning” (planning a set of work)</li>
<li>Create 2D planes that represent the same items in “layers” that can represent CVEs, latency, location, or can “nest” or subdivide</li>
</ul>
<p>When I was working in a similar space, a good friend of mine (kickass design leader) mentioned using “viscosity” to represent speed or “saturation” to represent age.  I think there are some fascinating ideas there, but I haven’t devoted cycles to exploring that further…also y’all are so skilled at leveraging these concepts that I can’t wait to see what y’all do next!</p>
<p>Thank you for sharing, and I reposted it :)</p>


<p>Is your goal to always present the information in a 3D space or are you also considering 2D?</p>


<p>I love this! This reminds me of William Gibson’s Neuromancer, how Case the protagonist moves across the matrix in a simulated 3D world that represents corporate data stores and their topology. While the nodes are great, they can be very disorienting for humans. I always envisioned a landscape, like a mirror of our own with the nodes represented as structures. The connections can still be there but spread out on a plane with maybe a FPS version and a Topdown version, which would be a toggle of course. I think having this helps users orient themselves. You could have a mini map! I have worked with Three.JS a lot so this really excites me as it is a real-world application rather than just web candy.</p>


<p>You will need to manually assign the similarity/distance values to the edges. Afterwards, you can use properties like gravity/charge/min-distance etc. to control the relative locations, and give the users a better sense of communities/clusters.</p>
