Working with the network interactions map

The network interactions map is a visual representation of detected communications between the devices in the industrial network. You can use the network interactions map to view information about communication between devices during various time periods.

The following objects can be displayed on the network interactions map:

• Nodes. These objects designate the sources and destinations of network packets.
• Device groups. These objects correspond to groups in the device group tree. Groups contain nodes that represent the devices and child groups embedded in those groups.
• Links. These objects represent connections between nodes.

Nodes and links appear on the network interactions map based on data received from traffic or from EPP applications for a specific time interval. Device groups are continually displayed.

If necessary, you can filter nodes and links. By default, the network interactions map displays objects in online mode with a defined filtering period of one hour.

Objects with issues are visually distinguished on the network interactions map. The application considers the following to be objects with issues:

• A node, if there are unprocessed events with a score 4.0 or higher associated with this node, or if this node represents a device with the Unauthorized status.
• A connection, if there are events with a score 4.0 or higher associated with this connection. Events registered during the defined object filtering period are taken into account. However, the current status of events is not taken into account.
• Group that contains devices with issues, or whose nodes have links with issues. This includes objects within the group and within any child group of all nesting levels.