Skip to main content
View as MarkdownOpen in ChatGPTOpen in Claude

Investigations

An investigation in Axiad Mesh is a drill-down. Starting from a workspace widget, you click something — an identity, a finding, a program, a step in an attack path — and Mesh opens a focus frame: a full-screen view, composed of detail widgets, all scoped to the one thing you clicked. Investigations aren't a separate feature you navigate to; they're how you follow any risk from the summary down to the evidence.

Drilling is deterministic​

A drill is not an AI step. Clicking a specific place in a specific widget maps to a pre-defined layout, and that layout dictates exactly which detail widgets appear and how the subject and inherited filters flow into them. The same click always opens the same investigation, and it opens fast — the language model isn't invoked on a drill.

Because a focus frame has a stable, shareable URL, an investigation can be handed off by link: bookmark it, paste it into a ticket, or drop it in chat, and the recipient lands on the same drilled-in view.

Investigating an identity​

Drilling into an identity composes a focus frame with:

  • Identity summary — name, state, correlation quality, risk score, loss exposure, and owner.
  • Open risks — the identity's findings ranked by severity and confidence and tagged by risk layer.
  • Correlated peers — the accounts Mesh has correlated to this identity, ranked by similarity, showing where the correlation came from.
  • The identity graph — the identity's relationships, drawn as a diagram (below).

The identity graph​

The identity graph is the two-hop neighborhood around one identity: the identity itself, everything correlated to it, and everything correlated to those — bounded so it stays fast and always draws the same graph for the same identity. It's a force-directed diagram where nodes are colored by kind — human, non-human identity, role, resource, group — and a legend labels them. Edges represent identity correlations and carry a similarity strength; an edge that lies on a critical access path is highlighted in red and labeled so you can see how access chains together.

The graph is a fast way to answer "what else is this connected to, and does any of it matter?" without leaving the investigation.

Attack paths (the kill chain)​

The kill chain widget shows your highest-exposure attack path as a left-to-right numbered flow — for example phishable MFA → session theft → token replay → API access → privilege escalation → data exfiltration — with the total annual loss exposure of the path. It answers "if an attacker chained our weaknesses together, what's the worst realistic route, and what would it cost?"

Drilling into a step opens that step's detail: the attacker technique it maps to, its share of the exposure, the identities it affects, and a timeline of the evidence behind it.

Moving through an investigation​

Every focus frame gives you the same controls:

  • Subject pill — the thing you drilled into, shown in the header and editable. Retype it and the whole frame re-binds to the new subject — a quick pivot from one identity or finding to the next without going back to the canvas.
  • Inherited filters — a frame carries in only the filters its layout declares (a time range, a department, a severity), marked as inherited; editing them affects the frame only.
  • Step back out — the frame's Back button, the browser Back button, and the Escape key all close the frame and return you to the canvas exactly where you were. A breadcrumb trail lets you pop to any depth.
  • Keep it — Pin as workspace turns the drilled-in view into a saved workspace; an admin can Save as template to make the drill layout reusable across the tenant.
  • Identities — the correlations the identity graph draws.
  • Risk scoring — the scores and layers findings carry.
  • Remediation — acting on what an investigation surfaces.
  • Generative UI — the workspace mechanics behind focus frames.