A map based on device attributes is used in the screen captures, but options for navigating a map and viewing its data apply to both types of visualization methods–Device Attributes and Purdue Levels.

A summary of various totals appears in the upper left of a visualization map.

The information that appears here is based on the device attribute visualization method. In this case, the first grouping is subnets and the second is categories. The number of devices on the map is always shown. If there are more than 5000 devices, “5000 Devices” is shown plus a pop-up message stating that the number of devices exceeds the limit and that some devices will not be shown. If this occurs, reduce the scope of the map.

Click the gear icon next to the map name to see the Edit <map-name> panel. You can view details about the map, such as the build scope, visualization method, and first and second sets of groups. You can also edit the map name and description.

In the upper right, is an information panel with a legend of what the colors and icons mean. Click to expand it.

The shade of blue stroke around the outside of the group bubble is in proportion to the number of highlighted devices in the group. The darker the blue, the more highlighted devices there are proportionally.

In the Advanced section of the legend, you can see the meanings of various map icons. By selecting and clearing their check boxes, you can toggle the icons on and off in the map.

The highlight tool, located at the upper right of a visualization map, helps you find devices with certain characteristics. To use it, enter one or more filters and then click

Highlight

. IoT Security highlights all groups and devices that match the filters. You can then drill down to the highlighted devices that match the filters. Clicking the

External Link

icon at the top of the device information panel opens the Device Details page for the device, where you can see relevant information.

If there’s more than one highlighted device in the group, first click the group name in the information panel on the right. Then select a highlighted device and click the

External Link

icon at the top of the device information panel to open the Device Details page for it.

You can also use links in the table to navigate through map layers. Click links in table columns to drill down deeper into the map and click links in the breadcrumbs above the table to move up to higher layers. You can also use links to display individual devices and open the Device Details page for it from the External Link icon in the table.

As you drill downward to view a device group in the second map layer, a toggle appears in the upper left to show or hide inner connections or connections within the same device grouping. Because connections between groups are typically of more interest, this is toggled off by default. To see inner connections, toggle on

Show inner connections

.

Because a device visualization map can show up to 5000 devices, sometimes you will need to zoom in and out to see more or less detail, and scroll left and right, up and down to move around the map to see details that are not visible in a single display.

When you click

+

or

-

in the zoom tool on the left of a map, the magnification increases or decreases in 5% increments. You can also use the scroll wheel on a mouse, or the equivalent on a touchpad, to zoom in and out.

You can also drag groups in the main map display to reposition them. IoT Security stores the new position in memory so you can return to the same layout the next time you view the map. This feature only works on the main map display. When you double-click a particular group, the group in focus always appears in the center of the map.

Hover your cursor over a group of devices to see the total number of devices and highlighted devices within it. You can hover your cursor over a group that contains other groups to see information about devices within all the groups or you can hover your cursor over one of the inner groups to see information just about that one.

Click a group to focus on it and see details about its contents.

Double-click a group in the map or an entry in the table under the map to drill into it and see the devices grouped in it.

The table below the map shows data about the devices in the selected group.

Click one of the devices to put it in focus and see information about it in a panel that appears along the right side of the page.

To see more information, click the

External Link

icon at the top of the device information panel to open its Device Details page in a new browser tab.

Then click the breadcrumb above the table to return to the previous map layer.

Solid lines indicate connections between device groups and between individual devices. Dashed lines indicate connections to Internet addresses, and to local IP endpoints and off-map devices, which are devices on the internal network to which devices on the map have connections but which are outside the scope defined for the map visualization and so do not appear on it.

Although you cannot interact with dashed lines, you can with solid lines. Hover your cursor over a solid line to make it bold. When it’s bold, it’s clickable. Clicking a bold line once draws focus to this connection by dimming the other groups and lines in the map. It also brings up a Group Connections information panel on the right side of the map. It shows information about the connection and the device groups on either end.

Clicking the bold line once again removes the focus and hides the information panel. However, double-clicking the bold line drills down to the next layer of the map—in this case, from subnets to profiles—and removes all the other device groups and lines to show just this connection line and the groups it connects.

Hovering your cursor over the line to make it bold and then clicking it once, again brings up the Group Connections information panel on the right. Note that while the information panel for the line in the first layer was about group connections by subnet, this one is about group connections by profile.

Hovering your cursor over the connection line to make it bold and then double-clicking it drills down to a deeper level, showing a closer look at the device connection and the devices involved. Clicking the line once brings up the Device Connections information panel.

By hovering your cursor over the connection line to make it bold and then double-clicking it once more, you’ll drill down to the last level, showing the two peer devices communicating with each other and the applications they're using.

When you reach this level, showing one or more connections between two peer devices, the lines indicate the direction of communications. There can be up to 4 types of direction:

When viewing individual devices, there are rings around them. Hover over the gray shaded center to see the device MAC address. Hover over the inner ring to see information in the second map layer. Hover over the outer ring to see information about the first map layer. The last ring is like a gray shadow indicating that the device is in focus.

Device visualization maps sometimes include off-map devices, IP endpoints, and Internet addresses whenever it’s necessary to show connections between devices defined within the scope of a visualization map and destinations outside that scope. Off-map devices and IP endpoints are located in the local, private network, and Internet addresses are located in the external public network. As with other device groups, you can also drill into groups of off-map devices and endpoints and Internet addresses. Click the group once to put it in focus and open an information panel.

Click the group twice to expand it. Hover your cursor over individual endpoints in the group to see their URLs. Click endpoints once see their information panels.