Microsoft Sentinel
Developer and APIGraph Visualization
In brief
The documentation now explains that only graphs materialized by published graph jobs appear in Graph management, on-demand job graphs are retained for 30 days, scheduled jobs rebuild graphs, and graph queries incur graph-meter charges. It also notes that predefined queries use a default LIMIT clause that can cap visualization results.
What Defender admins need to know
Administrators should account for graph retention and charges, monitor job schedules, and increase or remove query limits when complete results are required. No mandatory action is stated.
Summaries are generated from the documentation change itself.
Documentation change
View on Microsoft LearnThe comparison below shows only the changed extract. Use the full-page view for complete context.
Prerequisites
- To access the graph experience in Microsoft Sentinel and query
itthe graph experience to produce visualizations, you must have the appropriate permissions. For more information, see Get started with custom graphs in Microsoft Sentinel. Users of Sentinel Scope can't access Sentinel Graphs unless they hold one of four highly privileged roles that override scoping: Security Reader, Security Operator, Security Admin, or Global Admin.
Access graphs
To access the graph experience in Microsoft Sentinel, sign in to the Microsoft Defender portal, select Microsoft Sentinel > Graphs from the navigation pane.
The Sentinel Graph management page lists all custom graphs that you created usingwith the Microsoft Sentinel extension for Visual Studio Code Sentinel extension.and materialized by publishing a graph job. A graph created only in an interactive notebook session isn't available on this page. If you haven't createdpublished a custom graph, see Create a custom graph to get started.
If you already created custom graphs, the Graphs page in Microsoft Sentinel displays all available custom graphs. View an overview of each custom graph by selecting the ... menu on any graph tile.
Graphs published by an on-demand graph job are retained for 30 days and then deleted. Scheduled graph jobs rebuild graphs on their configured refresh schedules. If a graph is missing or its data is stale, review the graph job status and schedule in the Microsoft Sentinel extension for Visual Studio Code.
:::image type="content" source="media/graph-visualization/graphs-landing-page.png" alt-text="Screenshot showing how to access Sentinel graph from the Microsoft Sentinel navigation pane." lightbox="media/graph-visualization/graphs-landing-page.png":::
Select Query graph on the graph tile to view the graph query page.
Graph queries are billed under the Microsoft Sentinel graph meter. For more information, see Graph charges.
View the schema to understand the graph ontology – nodes, edges, and their properties available to query.
:::image type="content" source="media/graph-visualization/graph-creation-schema.png" alt-text="Screenshot showing the Sentinel graph creation page with the schema panel and query input." lightbox="media/graph-visualization/graph-creation-schema.png"::: ``` For more information on using GQL, see Graph Query Language (GQL) reference.
SelectRun GQL queryto view your results. You can cancel a query mid-execution. Copy the content of your query editor cell to share or save the query elsewhere.When the query finishes, the graph visualization appears. Some queries use operators likeCOLLECTLISTthat can't be rendered as a graph. These operators are reflected in the table view. In these instances, the graph tab displays a message explaining why a graph can't be renderedSelect any node to view the node details, including the properties associated with that node. Use this information to inform subsequent queries and visualizations.
By default, nodes are grouped on your graph visualization if they are the same node type, and connect to the same origin node by the same edge type. For example, "file" nodes and "accessed by" edges. Grouped nodes are represented by stacked circles on the descriptive layout and diamond shapes on the simplified layout. Node grouping produces a cleaner visualization with fewer nodes, which is important when investigating large graphs. To ungroup nodes, right-click and select ungroup to ungroup all nodes. Select the node group to open a right-hand pane of all nodes within that group. Select individual nodes to ungroup, leaving the unselected nodes in their original grouping. To regroup nodes, right-click on any node that was included in the group and select Regroup.
View node details
Select a node to open a details pane on the right side. Use the metadata shown here to refine future queries—for example, by filtering on geographic region, department, or last updated date.
Explore connected assets
Right-click the node, and select Explore connected assets to traverse the graph and view the next hop from this node. When viewing the detailed renderer, you can also traverse by clicking the plus "+" icon next to a node.
View a tabular representation of your data by selecting the Table tab. From the table, you can:
Validate that your GQL query produced the desired results.Search and sort the table to quickly find entities of interest.View the underlying JSON for an individual cell, providing key context that you can use in future queries.Export to CSV format for use in other preexisting workflows. Customize the table format by using theRETURNoperator to define the column structure, or order results to your preference. For more information, see the GQL documentationSelect Run GQL query to view your results. You can cancel a query mid-execution. Copy the content of your query editor cell to share or save the query elsewhere.
When the query finishes, the graph visualization appears. Some queries use operators like
COLLECTLISTthat can't be rendered as a graph. Operators that can't be rendered as a graph are reflected in the table view. When a query uses operators that can't be rendered as a graph, the graph tab displays a message explaining why the graph can't be renderedSelect any node to view the node details, including the properties associated with that node. Use this information to inform subsequent queries and visualizations.
By default, nodes are grouped on your graph visualization if they are the same node type, and connect to the same origin node by the same edge type. For example, "file" nodes and "accessed by" edges. Grouped nodes are represented by stacked circles on the descriptive layout and diamond shapes on the simplified layout. Node grouping produces a cleaner visualization with fewer nodes, which is important when investigating large graphs. To ungroup nodes, right-click and select ungroup to ungroup all nodes. Select the node group to open a right-hand pane of all nodes within that group. Select individual nodes to ungroup, leaving the unselected nodes in their original grouping. To regroup nodes, right-click on any node that was included in the group and select Regroup.
View node details
Select a node to open a details pane on the right side. Use the metadata shown in the details pane to refine future queries—for example, by filtering on geographic region, department, or last updated date.
Explore connected assets
Right-click the node, and select Explore connected assets to traverse the graph and view the next hop from this node. When viewing the detailed renderer, you can also traverse by clicking the plus "+" icon next to a node.
View a tabular representation of your data by selecting the Table tab. From the table, you can:
- Validate that your Graph Query Language (GQL) query produced the desired results.
- Search and sort the table to quickly find entities of interest.
- View the underlying JSON for an individual cell, providing key context that you can use in future queries.
- Export to CSV format for use in other preexisting workflows.
Customize the table format by using the
RETURNoperator to define the column structure, or order results to your preference. For more information, see the GQL documentation
ConfigurationConfigure graph visualization options
On the bottom right corner of the graph canvas, you can customize your graph visualization with a series of configuration options.
The first settings button offers a series of customization options for your graph visualization.
RendererChoose a graph renderer
To accommodate both targeted investigations and large-scale open exploration, the graph uses two different renderers to produce visualizations. By default, the renderer is set to "auto," which means the graph renders based on the number of displayed nodes. Use either the descriptive or simplified renderer according to your needs. The descriptive renderer is best suited for smaller graphs where detailed granularity is key. It includes small enhancements like plus ("+") icons next to each node for easy graph traversal, and grouped nodes are represented by stacked circles. The simplified renderer is better suited for large graphs with thousands of nodes, scaling for open exploration of the presented data, and represents node groups as diamond shapes.
The following image below demonstrates the difference between the descriptive renderer on the left and the simplified renderer on the right renderers.right.
:::image type="content" source="media/graph-visualization/renderer-comparison.png" alt-text="Screenshot showing the difference between the descriptive and simplified renderers in graph visualization." lightbox="media/graph-visualization/renderer-comparison.png":::
LayoutSelect a graph layout
You have the option to change the layout of your graph from "force" (default) to "directed." The force layout automatically displays nodes based on their connections, producing an interconnected graph where anomalies are easy to identify. The directed layout follows a stricter structure, organizing nodes top-down in a clean, linear manner. The following image below demonstrates the directed layout.
:::image type="content" source="media/graph-visualization/directed-layout.png" alt-text="Screenshot showing the directed layout of a graph visualization." lightbox="media/graph-visualization/directed-layout.png":::
BehaviorConfigure graph interaction behavior
By default, the "Preserve positions on data change" option is selected. ThisThe "Preserve positions on data change" setting ensures that actions like node connection expansion or grouping/ungrouping don't change the positioning of other nodes. Turning thisoff the "Preserve positions on data change" setting off shifts the positioning of existing nodes when thesenode connection expansion or grouping and ungrouping actions are taken.
ActionsAvailable graph actions
Selecting "Realign graph" reverts the graph to its original state.
LayersConfigure graph layers
By default, both node and edge labels are visible on the graph, as well as icons for pre-defined graphs. Turn off labels and icons from the settings menu.
Zoom to fit
Select the zoom to fit option to reposition your graph so that all nodes are visible and take up the majority of your graph canvas screen. While the "Realign graph" option reverts the graph back to its original state, thisthe zoom to fit option simply fits the graph (with any moved nodes or other customizations) within your screen.
@@ -4,12 +4,12 @@ description: Learn how to use Microsoft Sentinel graph to query, visualize, and ms.author: edbaynash author: EdB-MSFT ms.reviewer: dandennis-ms.date: 06/12/2026+ms.date: 08/07/2026 ms.topic: how-to ms.service: microsoft-sentinel ms.subservice: sentinel-graph ai-usage: ai-assisted-ms.custom: msecd-doc-authoring-1014+ms.custom: msecd-doc-authoring-1015 #Customer intent: As a security analyst, I want to use Microsoft Sentinel graph to query and visualize custom security graphs so that I can gain new insights into entity relationships and threats in my environment. ---@@ -22,17 +22,19 @@ Use Microsoft Sentinel graph to query, visualize, and interact with graphs to ob ## Prerequisites -+ To access the graph experience in Microsoft Sentinel and query it to produce visualizations, you must have the appropriate permissions. For more information, see [Get started with custom graphs in Microsoft Sentinel](./create-custom-graphs.md#permissions). Users of Sentinel Scope can't access Sentinel Graphs unless they hold one of four highly privileged roles that override scoping: Security Reader, Security Operator, Security Admin, or Global Admin.++ To access the graph experience in Microsoft Sentinel and query the graph experience to produce visualizations, you must have the appropriate permissions. For more information, see [Get started with custom graphs in Microsoft Sentinel](./create-custom-graphs.md#permissions). Users of Sentinel Scope can't access Sentinel Graphs unless they hold one of four highly privileged roles that override scoping: Security Reader, Security Operator, Security Admin, or Global Admin. ## Access graphs To access the graph experience in Microsoft Sentinel, sign in to the Microsoft Defender portal, select **Microsoft Sentinel** > **Graphs** from the navigation pane. -The Sentinel Graph management page lists all custom graphs you created using the Visual Studio Code Sentinel extension. If you haven't created a custom graph, see [Create a custom graph](./create-custom-graphs.md) to get started.+The Sentinel Graph management page lists custom graphs that you created with the Microsoft Sentinel extension for Visual Studio Code and materialized by publishing a graph job. A graph created only in an interactive notebook session isn't available on this page. If you haven't published a custom graph, see [Create a custom graph](./create-custom-graphs.md) to get started. If you already created custom graphs, the **Graphs** page in Microsoft Sentinel displays all available custom graphs. View an overview of each custom graph by selecting the **...** menu on any graph tile. +Graphs published by an on-demand graph job are retained for 30 days and then deleted. Scheduled graph jobs rebuild graphs on their configured refresh schedules. If a graph is missing or its data is stale, review the graph job status and schedule in the Microsoft Sentinel extension for Visual Studio Code.+ :::image type="content" source="media/graph-visualization/graphs-landing-page.png" alt-text="Screenshot showing how to access Sentinel graph from the Microsoft Sentinel navigation pane." lightbox="media/graph-visualization/graphs-landing-page.png"::: @@ -40,6 +42,8 @@ If you already created custom graphs, the **Graphs** page in Microsoft Sentinel Select **Query graph** on the graph tile to view the graph query page. +Graph queries are billed under the Microsoft Sentinel graph meter. For more information, see [Graph charges](../billing.md#graph-charges).+ View the schema to understand the graph ontology – nodes, edges, and their properties available to query. :::image type="content" source="media/graph-visualization/graph-creation-schema.png" alt-text="Screenshot showing the Sentinel graph creation page with the schema panel and query input." lightbox="media/graph-visualization/graph-creation-schema.png":::@@ -62,9 +66,12 @@ View the schema to understand the graph ontology – nodes, edges, and their pro ``` For more information on using GQL, see [Graph Query Language (GQL) reference](./gql-reference-for-sentinel-custom-graph.md). + > [!NOTE]+ > Predefined queries include a default `LIMIT` clause (for example, `LIMIT 100`) that caps the number of results returned. This default keeps initial visualizations responsive, but you see only a subset of your graph data. To see all matching results, edit the query to increase the value or remove the `LIMIT` clause before you run it. Returning large result sets can affect performance, so increase the limit incrementally to find the right balance for your graph.+ 1. Select **Run GQL query** to view your results. You can cancel a query mid-execution. Copy the content of your query editor cell to share or save the query elsewhere. -1. When the query finishes, the graph visualization appears. Some queries use operators like `COLLECTLIST` that can't be rendered as a graph. These operators are reflected in the table view. In these instances, the graph tab displays a message explaining why a graph can't be rendered+1. When the query finishes, the graph visualization appears. Some queries use operators like `COLLECTLIST` that can't be rendered as a graph. Operators that can't be rendered as a graph are reflected in the table view. When a query uses operators that can't be rendered as a graph, the graph tab displays a message explaining why the graph can't be rendered 1. Select any node to view the node details, including the properties associated with that node. Use this information to inform subsequent queries and visualizations. @@ -96,7 +103,7 @@ When you hover over a node, the graph highlights its connections and hides unrel By default, nodes are grouped on your graph visualization if they are the same node type, and connect to the same origin node by the same edge type. For example, "file" nodes and "accessed by" edges. Grouped nodes are represented by stacked circles on the descriptive layout and diamond shapes on the simplified layout. Node grouping produces a cleaner visualization with fewer nodes, which is important when investigating large graphs. To ungroup nodes, right-click and select **ungroup** to ungroup all nodes. Select the node group to open a right-hand pane of all nodes within that group. Select individual nodes to ungroup, leaving the unselected nodes in their original grouping. To regroup nodes, right-click on any node that was included in the group and select **Regroup**. ### View node details-Select a node to open a details pane on the right side. Use the metadata shown here to refine future queries—for example, by filtering on geographic region, department, or last updated date.+Select a node to open a details pane on the right side. Use the metadata shown in the details pane to refine future queries—for example, by filtering on geographic region, department, or last updated date. ### Explore connected assets Right-click the node, and select **Explore connected assets** to traverse the graph and view the next hop from this node. When viewing the detailed renderer, you can also traverse by clicking the plus "+" icon next to a node.@@ -126,7 +133,7 @@ You can also create direct links to your graph queries that will open your graph View a tabular representation of your data by selecting the **Table** tab. From the table, you can: -- Validate that your GQL query produced the desired results.+- Validate that your Graph Query Language (GQL) query produced the desired results. - Search and sort the table to quickly find entities of interest. - View the underlying JSON for an individual cell, providing key context that you can use in future queries. - Export to CSV format for use in other preexisting workflows.@@ -136,7 +143,8 @@ View a tabular representation of your data by selecting the **Table** tab. From Customize the table format by using the `RETURN` operator to define the column structure, or order results to your preference. For more information, see the [GQL documentation](./gql-reference-for-sentinel-custom-graph.md). -## Configuration options +<a name="configuration-options"></a>+## Configure graph visualization options On the bottom right corner of the graph canvas, you can customize your graph visualization with a series of configuration options. @@ -144,34 +152,39 @@ On the bottom right corner of the graph canvas, you can customize your graph vis The first settings button offers a series of customization options for your graph visualization. -#### Renderer+<a name="renderer"></a>+#### Choose a graph renderer To accommodate both targeted investigations and large-scale open exploration, the graph uses two different renderers to produce visualizations. By default, the renderer is set to "auto," which means the graph renders based on the number of displayed nodes. Use either the descriptive or simplified renderer according to your needs. The descriptive renderer is best suited for smaller graphs where detailed granularity is key. It includes small enhancements like plus ("+") icons next to each node for easy graph traversal, and grouped nodes are represented by stacked circles. The simplified renderer is better suited for large graphs with thousands of nodes, scaling for open exploration of the presented data, and represents node groups as diamond shapes. -The image below demonstrates the difference between the descriptive on the left and simplified on the right renderers.+The following image demonstrates the difference between the descriptive renderer on the left and the simplified renderer on the right. :::image type="content" source="media/graph-visualization/renderer-comparison.png" alt-text="Screenshot showing the difference between the descriptive and simplified renderers in graph visualization." lightbox="media/graph-visualization/renderer-comparison.png"::: -#### Layout+<a name="layout"></a>+#### Select a graph layout -You have the option to change the layout of your graph from "force" (default) to "directed." The force layout automatically displays nodes based on their connections, producing an interconnected graph where anomalies are easy to identify. The directed layout follows a stricter structure, organizing nodes top-down in a clean, linear manner. The image below demonstrates the directed layout.+You have the option to change the layout of your graph from "force" (default) to "directed." The force layout automatically displays nodes based on their connections, producing an interconnected graph where anomalies are easy to identify. The directed layout follows a stricter structure, organizing nodes top-down in a clean, linear manner. The following image demonstrates the directed layout. :::image type="content" source="media/graph-visualization/directed-layout.png" alt-text="Screenshot showing the directed layout of a graph visualization." lightbox="media/graph-visualization/directed-layout.png"::: -#### Behavior+<a name="behavior"></a>+#### Configure graph interaction behavior -By default, the "Preserve positions on data change" option is selected. This setting ensures that actions like node connection expansion or grouping/ungrouping don't change the positioning of other nodes. Turning this setting off shifts the positioning of existing nodes when these actions are taken.+By default, the "Preserve positions on data change" option is selected. The "Preserve positions on data change" setting ensures that actions like node connection expansion or grouping/ungrouping don't change the positioning of other nodes. Turning off the "Preserve positions on data change" setting shifts the positioning of existing nodes when node connection expansion or grouping and ungrouping actions are taken. -#### Actions+<a name="actions"></a>+#### Available graph actions Selecting "Realign graph" reverts the graph to its original state. -### Layers+<a name="layers"></a>+### Configure graph layers By default, both node and edge labels are visible on the graph, as well as icons for pre-defined graphs. Turn off labels and icons from the settings menu. @@ -182,7 +195,7 @@ Select fullscreen to view your graph in full screen mode, providing significantl ### Zoom to fit -Select the zoom to fit option to reposition your graph so that all nodes are visible and take up the majority of your graph canvas screen. While the "Realign graph" option reverts the graph back to its original state, this option simply fits the graph (with any moved nodes or other customizations) within your screen. +Select the zoom to fit option to reposition your graph so that all nodes are visible and take up the majority of your graph canvas screen. While the "Realign graph" option reverts the graph back to its original state, the zoom to fit option simply fits the graph (with any moved nodes or other customizations) within your screen.