G DATA 365 | MXDR

This is essentially the alert graph and shows all the processes associated with the alert. In this visualized representation you can see which processes have triggered other processes and what has happened in selected processes.
Which process triggered other processes? What happened in which files on the system? Have changes been made in the Windows registry and if so, what has changed there in detail? Was there any external communication and where to?
All of these questions can be analyzed in detail.

The graph can contain a large number of individual processes and take up a correspondingly large amount of space. You can move the viewing point in the window with the left mouse button and zoom in and out of the graph with the mouse wheel. Alternatively, you can use the buttons next to the current zoom level () for adjustments.
To the left of this is a button for restoring the viewing point () to the original location and magnification level.

A process with a warning sing represents the core of the detection of the alert in question. The processes can be selected individually and are then highlighted in blue. All detail information displayed below the graph refers to the selected, highlighted process. By default, the view of the message graph is centered onto the selected process. You can adjust this behavior by clicking on the gear icon ().

The detail information about the processes are broken down into the categories Process Details, File Operations, Registry Operations und Network Operations. Non-suspicious operations provide contextual information about the processes, suspicious operations have direct ties to the detection. With the “Show only suspicious operations” button, only suspicious entries are displayed in the File Operations and Registry Operations tabs.