Graph search

Graph Search provides an interactive, visual way to explore your assets and findings by their relationships. Instead of working through raw data alone, you get a graphical view of how assets, security findings, and their context connect, making it easier to spot attack paths and hidden risks and act on them faster.

Note: For more information, see the Cortex Cloud Graph Search documentation.

The following sections provide examples of how you can use Graph Search across the main capabilities of Cortex Data Security.

Data Security Posture Management (DSPM)

DSPM searches help identify where sensitive data resides and the risks associated with it, such as public exposure or the presence of malware on sensitive assets. See the following examples as starting points for building your queries:

AWS Buckets Containing Sensitive Data

Surfaces AWS storage buckets that have a data finding for sensitive content, helping you locate where regulated or confidential data resides across your AWS estate so you can prioritize protection.

FIND Bucket WHERE Provider = AWS
  THAT Has Data Finding WHERE Finding Name = Sensitive data found

GCP Buckets Containing Sensitive Data

Surfaces GCP storage buckets that have a data finding for sensitive content, giving you the same sensitive-data visibility across Google Cloud. Change the Provider value to pivot the same search to other cloud storage assets.

FIND Bucket WHERE Provider = GCP
  THAT Has Data Finding WHERE Finding Name = Sensitive data found

AI Security Posture Management (AISPM)

AISPM helps organizations monitor their AI footprint and the security posture of AI assets, ensuring models are accounted for and protected from common LLM vulnerabilities. See the following examples as starting points for building your queries:

AI Models Deployed on Vulnerable Virtual Machines

Traces the deployment path of your AI models to the underlying compute, surfacing models that run on virtual machines carrying vulnerability findings. This highlights AI workloads exposed to infrastructure-level risk, so you can prioritize patching the hosts that put your models at risk.

FIND AI Model
  THAT Deployed On Virtual Machine
    THAT Has Vulnerability Finding

AI Models Trained On Datasets

Maps the lineage between your AI models and the datasets they were trained on, giving you visibility into which data sources feed each model. This is a starting point for governing training data and can be extended with additional relationships (for example, to check whether those datasets contain sensitive data).

FIND AI Model
  THAT Trained On Dataset

Data Access Governance

Data access governance queries use identity context to surface which identities can reach your sensitive data stores and where that access is risky—helping you enforce least privilege and govern who can access your data. See the following examples as starting points for building your queries:

Identities with Excessive Permissions

Surfaces cloud identities that carry overly broad or unneeded access—such as AWS policies with full wildcard permissions—so you can enforce least privilege and remediate risky access to your resources. Adjust the Finding Name value in the dropdown to look for other excessive assignments, such as Excessive AWS policy with service level wildcard... or Excessive Azure Role Assignment found.

FIND Identity
  THAT Has Identity Finding WHERE Finding Name = Excessive AWS policy with full wildcard...