Map Pivot Paths Across Network, Endpoint, Identity, Email & Cloud Artifacts

Free interactive pivot graph for security investigations. Click any artifact, follow the highlighted connections, and build a traceable path from first indicator to full scope.

36Artifacts

168+Pivot Paths

5Categories

THEORY

One indicator rarely tells the full story. Pivoting means using a single artifact, an IP, a hash, a user account, as a starting point, then following its real relationships outward to surface everything else connected to the same activity.
Every pivot needs a source, not just a line on a graph. A relationship is only as useful as the log or tool that can confirm it, that's why each edge here carries both a relationship verb and a PRIMARY SOURCES list, not just an arrow.
Investigations cross category boundaries. A phishing email (Email) leads to a URL (Network) that drops a file (Endpoint) that creates a scheduled task (Endpoint) under a compromised account (Identity). The 5 categories exist to make those crossings visible, not to keep artifacts siloed.

ANALYSIS

Start narrow, expand deliberately: begin from the one artifact you've actually confirmed. Don't chase every visible edge, only the ones your case needs.
Validate before you pivot: check DATA SOURCE MAPPING for the artifact you're about to add. No matching log source in your environment means that pivot is theoretical, not actionable yet.
Tag technique, not just artifact: a registry key or scheduled task pivot usually maps to a persistence technique. Attach the MITRE tag so the finished path reads as a technique chain, not a bare artifact list.
Export early, refine often: a pivot path is a working hypothesis. COPY or CSV it as you go so a dead end doesn't cost you the trail you already built.

HOW TO USE

Pick a starting artifact: click a category chip (NET / EPT / IDN / EML / CLD) to filter, or click ALL, then click any artifact chip or graph node directly to select it.
Read the info panel: category, description, real-world data sources, and the PIVOT TO list appear on the left. Click a MITRE ATT&CK tag to open the technique page.
Build a pivot path: click a highlighted, connected node to extend the path. The breadcrumb bar above the graph tracks every hop.
Copy or export: use COPY for a plain-text trail, or CSV to export the full path with category, relationship, data source, and MITRE columns.

LAYOUTS

⭙Force, physics-based clustering (default)

○Circle, Concentric, and Grid, switch anytime

◎Focus mode, dims everything but the selected node's neighbors

↻Reset, re-runs the active layout from scratch

CAPABILITIES

36 artifact types, 5 categoriesNetwork, Endpoint, Identity, Email, and Cloud artifacts, filterable by category chip or individually.

168+ tagged relationshipsEvery pivot edge carries a real relationship verb (resolves_to, executed_by, spawned_by, and more), listed in the CROSS-PIVOT REFERENCE table below the graph.

MITRE ATT&CK taggingRelevant artifacts link straight out to the technique page on attack.mitre.org.

Pivot path builderClick connected nodes to build a traceable path, then COPY it as text or export it as CSV with Step, From/To, Category, Relationship, Data Sources, and MITRE columns.

4 graph layoutsForce, Circle, Concentric, and Grid. Switch anytime without losing your pivot path.

Real-world data source mappingEvery artifact type lists the logs and tools (EDR, SIEM, Sysmon event IDs, and more) that would actually surface it, in the DATA SOURCE MAPPING table below the graph.

READING THE GRAPH

Node color = categoryEvery node's border and label color match its category. Click a node (or an artifact chip) to open its info panel: description, data sources, pivot-to list, and MITRE tags.

Highlight and dimSelecting a node highlights its direct connections and dims the rest of the graph, no positions move. Click a highlighted node to extend your pivot path.

Category colors

NETNetwork (14) EPTEndpoint (16) IDNIdentity (3) EMLEmail (2) CLDCloud (1)

HOW IT WORKS

A static, curated graphAll 36 artifacts and 168+ relationships are hand-defined ahead of time, not generated or inferred live. Every pivot path you can build already existed in the data before you clicked anything.

Node size = connection countA circle's size is computed from how many real relationships that artifact has, relative to the busiest node in the graph. Process and IP are the largest nodes because they sit on the most pivot paths, not because they were sized by hand.

Arrow shape = relationship typeAn edge's arrowhead encodes what kind of relationship it is: a V for execution (spawned_by, executed_by), a square for containment or ownership (has_hash, contains), a circle for observation or association, everything else stays a plain triangle.

Highlight and dim, never moveSelecting a node applies a highlighted state to it and its direct neighbors and a dimmed state to everything else, a pure visual change. Node positions are never recalculated on click.

Focus mode reuses that same stateFocus doesn't run a new query, it hides whatever's already marked dimmed. Turning it back off simply un-hides the same nodes.

Force layout is real physicsThe default arrangement runs a force-directed simulation, node repulsion plus edge attraction over ~1,500 iterations, so related artifacts naturally cluster together. Circle, Concentric, and Grid are pure geometric placements with no simulation involved.

36 artifacts168+ pivots

◈

Select an artifact or click any node.

CROSS-PIVOT REFERENCE

FROM	TO	PURPOSE
NETIP	→Domain / FQDN	resolves_to: Passive DNS pivot
NETIP	→SSL Certificate	presents: Cert infra clustering
NETIP	→Net Session	communicates_with: Session pivot
NETDomain	→IP / FQDN / URL	resolves_to / parent_of / hosts
NETDomain	→SSL Certificate	uses: Cert-based infra link
NETURL	→File	delivers: Payload download chain
NETURL	→HTTP Request	requested_via: Request trace
NETNet Session	→IP / Domain	originates_from / queries
NETSSL Certificate	→Domain / IP	issued_to / used_by
NETJA3	→IP / Domain	observed_on / connects_to
NETUser Agent	→URL / Net Session	accesses / part_of
NETDNS Query	→Domain / IP / Host	queries / resolves_to / originates_from
NETNetwork Traffic	→IP / Net Session	involves / part_of: Traffic scope
NETASN	→IP / Domain	contains / resolves_to: Infra attribution
NETPort	→IP / Host / Service	open_on / exposes: Service fingerprint
EPTHash	→File	identifies: File artifact lookup
EPTHash	→URL / IP / Domain	downloaded_from / hosted_on / associated_with
EPTHash	→Process	executed_by: Execution chain
EPTFile	→Hash / Process	has_hash / executed_by
EPTFile	→Host / User	exists_on / owned_by
EPTFile Path	→File	points_to: On-disk lookup
EPTCommand Line	→Process	executed_by: LOLBin / cmdline trace
EPTEvent ID	→Process / Host	observed_on / part_of: Event context
EPTProcess	→Command Line	executed_with: LOLBin analysis
EPTProcess	→Registry	modifies: Persistence write
EPTProcess	→Sched. Task / Startup Item	creates: Persistence chain
EPTProcess	→Process	spawned_by / spawns: Tree walk
EPTProcess	→File / User / Host	runs / executed_as / runs_on
EPTShare	→Host / File / User	exists_on / contains / accessed_by
EPTHost	→Process / File / User	runs / stores / used_by
EPTHost	→Net Session	generates: Session scope
EPTVuln ID	→Host	affects: Affected asset scope
EPTService	→Process / Host / File	runs_as / runs_on / loads: Service chain
EPTMutex	→Process / Host / Hash	created_by / observed_on / associated_with
EPTNamed Pipe	→Process / Host	created_by / observed_on: IPC pivot
EPTDLL	→Process / Host / Hash	loaded_by / observed_on / has_hash
EPTProcess	→Net Session / IP	communicates_with: Network beacon pivot
IDNUser	→Host / Process	logs_into / executes
IDNUser	→IP / Cloud Resource	originates_from / accesses
IDNRDP Session	→Host / User	connects_to / initiated_by
IDNIdentity	→User	represents: Cloud identity map
EMLEmail	→Attachment / URL	contains: Phishing chain
EMLEmail	→Domain	originates_from: Sender pivot
EMLAttachment	→Hash	has_hash: Payload hash
CLDCloud Resource	→Identity / IP	owned_by / exposed_via

DATA SOURCE MAPPING

ARTIFACT TYPE	PRIMARY SOURCES
IP Address	Firewall · SIEM · NetFlow · Proxy · Shodan · AbuseIPDB
Domain	Passive DNS · Proxy logs · DNS server logs · RiskIQ · SecurityTrails
FQDN	DNS logs · Sysmon Event 22 · EDR · Proxy
URL	Proxy logs · Email Gateway · Browser history · EDR · Zeek
DNS Query	DNS logs · Sysmon Event 22 · EDR · Network tap
HTTP Request	Proxy · Zeek · Suricata · Firewall · Network sensor
SSL Cert / SSL Certificate	Censys · Shodan · crt.sh · JARM · Passive DNS
JA3 Hash	Network sensor · Zeek · Suricata · PCAP
User Agent	Proxy · Zeek · Firewall logs · SIEM
Net Traffic	NetFlow · PCAP · Zeek · Suricata · Firewall
Net Session	NetFlow · Firewall · Proxy · Zeek · EDR
ASN	WHOIS · BGP tables · Shodan · RIPEstat · ipinfo.io
Port	Shodan · Censys · Masscan · Nmap · Firewall logs
File Hash	EDR · AV · Sandbox · MalwareBazaar · VirusTotal
File	EDR · Sandbox · AV · MalwareBazaar · File system audit
File Path	EDR · Sysmon Event 11 · MFT · USN Journal · KAPE
Process	EDR · Sysmon Event 1 · WinEvent 4688 · Process Monitor
Command Line	EDR · Sysmon Event 1 · WinEvent 4688 · PowerShell ScriptBlock
Registry Key	Sysmon 12-14 · EDR · WinEvent 4657 · Autoruns · reg.exe
Scheduled Task	WinEvent 4698 · Task Scheduler logs · EDR · Autoruns
Startup Item	Autoruns · EDR · Sysmon · Registry audit · WinEvent 4688
Host	EDR · SIEM · AD · CMDB · Vuln Scanner
Network Share	WinEvent 5140/5145 · EDR · Sysmon · AD
Event ID	Windows Event Log · SIEM · Splunk · Elastic
Vuln ID (CVE)	NVD · CISA KEV · Tenable · Qualys · Shodan
Service	EDR · Sysmon Event 4 · WinEvent 7045 · SC.exe · Autoruns
Mutex	EDR · Sysmon Event 17/18 · Sandbox · Process Monitor
Named Pipe	EDR · Sysmon Event 17/18 · Process Monitor · PipeView
DLL	EDR · Sysmon Event 7 · PE analysis · VirusTotal · Sandbox
User	AD logs · IAM · Okta · SIEM · UEBA
Identity	Azure AD · AWS IAM · GCP SA · Okta · CloudTrail
RDP Session	WinEvent 4624/4778/4779 · EDR · NetFlow · Security Onion
Email	Email Gateway · O365 Message Trace · Proofpoint · Mimecast
Attachment	Email Gateway · Sandbox · AV · EDR · O365 ATP
Cloud Resource	CloudTrail · Azure Monitor · GCP Audit · GuardDuty

NODE LEGEND

NETWORK (14)

ENDPOINT (16)

IDENTITY (3)

EMAIL (2)

CLOUD (1)

Click chip or node → centers artifact, highlights next pivots · Click highlighted node → extends path · Breadcrumb tracks traversal