The network interaction map is a visual representation of detected communications between the devices in the industrial network. You can use the network interaction map to view information about communication between devices during various time periods.
The following objects can be displayed on the network interaction map:
Nodes. These objects designate the sources and destinations of network packets.
Device groups. These objects correspond to groups in the device group tree. Groups contain nodes that represent the devices and child groups embedded in those groups.
Links. These objects represent connections between nodes.
Nodes and links appear on the network interaction map based on data received from traffic or from EPP applications for a specific time interval. Device groups are continually displayed.
If necessary, you can filter nodes and links. By default, the network interaction map displays objects in real time with a defined filtering period of one hour.
Objects with issues are visually distinguished on the network interaction map. The application considers the following to be objects with issues:
A node, if there are unprocessed events with a score 4.0 or higher associated with this node, or if this node represents a device with a status of Unauthorized.
A connection, if there are events with a score 4.0 or higher associated with this connection. Events registered during the defined object filtering period are taken into account. However, the current status of events is not taken into account.
Group that contains devices with issues, or whose nodes have links with issues. This includes objects within the group and within any child group of all nesting levels.