[{"data":1,"prerenderedAt":471},["ShallowReactive",2],{"cycle-doc-bob-wire-c18-precedents\u002FREADME.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":18},{"id":5,"title":6},"c18","Post-Mortem Map",{"id":8,"label":9},"bob-wire","Bob-Wire","precedents\u002FREADME.md","Precedent Screenshots",[13,14,15,16,17],"Microsoft Defender XDR","Amazon Detective","SentinelOne Storyline \u002F Process Graph","Wiz Security Graph","Not captured",{"type":19,"children":20},"root",[21,38,44,170,175,247,252,345,350,422,427],{"type":22,"tag":23,"props":24,"children":25},"element","p",{},[26,29,36],{"type":27,"value":28},"text","Product screenshots of the incident-map precedents surveyed in ",{"type":22,"tag":30,"props":31,"children":33},"a",{"href":32},"\u002Fcycles\u002Fbob-wire\u002Fc18\u002Fdoc\u002Fprecedents",[34],{"type":27,"value":35},"..\u002Fprecedents.md",{"type":27,"value":37},". Downloaded 2026-07-24 from vendor docs\u002Fblogs; internal design-research reference only.",{"type":22,"tag":39,"props":40,"children":42},"h2",{"id":41},"microsoft-defender-xdr",[43],{"type":27,"value":13},{"type":22,"tag":45,"props":46,"children":47},"table",{},[48,72],{"type":22,"tag":49,"props":50,"children":51},"thead",{},[52],{"type":22,"tag":53,"props":54,"children":55},"tr",{},[56,62,67],{"type":22,"tag":57,"props":58,"children":59},"th",{},[60],{"type":27,"value":61},"File",{"type":22,"tag":57,"props":63,"children":64},{},[65],{"type":27,"value":66},"Shows",{"type":22,"tag":57,"props":68,"children":69},{},[70],{"type":27,"value":71},"Source",{"type":22,"tag":73,"props":74,"children":75},"tbody",{},[76,106,128,149],{"type":22,"tag":53,"props":77,"children":78},{},[79,90,95],{"type":22,"tag":80,"props":81,"children":82},"td",{},[83],{"type":22,"tag":84,"props":85,"children":87},"code",{"className":86},[],[88],{"type":27,"value":89},"defender-attack-story-play.gif",{"type":22,"tag":80,"props":91,"children":92},{},[93],{"type":27,"value":94},"Animated: \"playing\" the attack story graph chronologically — alerts\u002Fnodes appear in time order",{"type":22,"tag":80,"props":96,"children":97},{},[98],{"type":22,"tag":30,"props":99,"children":103},{"href":100,"rel":101},"https:\u002F\u002Fgithub.com\u002FMicrosoftDocs\u002Fdefender-docs\u002Fblob\u002Fpublic\u002Fdefender-xdr\u002Finvestigate-incidents.md",[102],"nofollow",[104],{"type":27,"value":105},"MS Defender docs (GitHub)",{"type":22,"tag":53,"props":107,"children":108},{},[109,118,123],{"type":22,"tag":80,"props":110,"children":111},{},[112],{"type":22,"tag":84,"props":113,"children":115},{"className":114},[],[116],{"type":27,"value":117},"defender-attack-story-entity-details.gif",{"type":22,"tag":80,"props":119,"children":120},{},[121],{"type":27,"value":122},"Animated: clicking a graph node to open the entity pane and take remediation actions",{"type":22,"tag":80,"props":124,"children":125},{},[126],{"type":27,"value":127},"same",{"type":22,"tag":53,"props":129,"children":130},{},[131,140,145],{"type":22,"tag":80,"props":132,"children":133},{},[134],{"type":22,"tag":84,"props":135,"children":137},{"className":136},[],[138],{"type":27,"value":139},"defender-blast-radius-graph.png",{"type":22,"tag":80,"props":141,"children":142},{},[143],{"type":27,"value":144},"Blast-radius graph — top-rated attack paths from a compromised asset",{"type":22,"tag":80,"props":146,"children":147},{},[148],{"type":27,"value":127},{"type":22,"tag":53,"props":150,"children":151},{},[152,161,166],{"type":22,"tag":80,"props":153,"children":154},{},[155],{"type":22,"tag":84,"props":156,"children":158},{"className":157},[],[159],{"type":27,"value":160},"defender-incident-graph-filter.png",{"type":22,"tag":80,"props":162,"children":163},{},[164],{"type":27,"value":165},"Incident graph with filter controls (severity, entity-type hiding)",{"type":22,"tag":80,"props":167,"children":168},{},[169],{"type":27,"value":127},{"type":22,"tag":39,"props":171,"children":173},{"id":172},"amazon-detective",[174],{"type":27,"value":14},{"type":22,"tag":45,"props":176,"children":177},{},[178,196],{"type":22,"tag":49,"props":179,"children":180},{},[181],{"type":22,"tag":53,"props":182,"children":183},{},[184,188,192],{"type":22,"tag":57,"props":185,"children":186},{},[187],{"type":27,"value":61},{"type":22,"tag":57,"props":189,"children":190},{},[191],{"type":27,"value":66},{"type":22,"tag":57,"props":193,"children":194},{},[195],{"type":27,"value":71},{"type":22,"tag":73,"props":197,"children":198},{},[199,226],{"type":22,"tag":53,"props":200,"children":201},{},[202,211,216],{"type":22,"tag":80,"props":203,"children":204},{},[205],{"type":22,"tag":84,"props":206,"children":208},{"className":207},[],[209],{"type":27,"value":210},"aws-detective-finding-group-graph.png",{"type":22,"tag":80,"props":212,"children":213},{},[214],{"type":27,"value":215},"Finding-group interactive graph — resources, findings, and their connections for one security event",{"type":22,"tag":80,"props":217,"children":218},{},[219],{"type":22,"tag":30,"props":220,"children":223},{"href":221,"rel":222},"https:\u002F\u002Faws.amazon.com\u002Fblogs\u002Fpublicsector\u002Fdetect-and-investigate-amazon-ec2-malware-with-amazon-guardduty-and-amazon-detective\u002F",[102],[224],{"type":27,"value":225},"AWS Public Sector blog",{"type":22,"tag":53,"props":227,"children":228},{},[229,238,243],{"type":22,"tag":80,"props":230,"children":231},{},[232],{"type":22,"tag":84,"props":233,"children":235},{"className":234},[],[236],{"type":27,"value":237},"aws-detective-investigation-report.png",{"type":22,"tag":80,"props":239,"children":240},{},[241],{"type":27,"value":242},"Investigation report summary page that sits alongside the graph",{"type":22,"tag":80,"props":244,"children":245},{},[246],{"type":27,"value":127},{"type":22,"tag":39,"props":248,"children":250},{"id":249},"sentinelone-storyline-process-graph",[251],{"type":27,"value":15},{"type":22,"tag":45,"props":253,"children":254},{},[255,273],{"type":22,"tag":49,"props":256,"children":257},{},[258],{"type":22,"tag":53,"props":259,"children":260},{},[261,265,269],{"type":22,"tag":57,"props":262,"children":263},{},[264],{"type":27,"value":61},{"type":22,"tag":57,"props":266,"children":267},{},[268],{"type":27,"value":66},{"type":22,"tag":57,"props":270,"children":271},{},[272],{"type":27,"value":71},{"type":22,"tag":73,"props":274,"children":275},{},[276,303,324],{"type":22,"tag":53,"props":277,"children":278},{},[279,288,293],{"type":22,"tag":80,"props":280,"children":281},{},[282],{"type":22,"tag":84,"props":283,"children":285},{"className":284},[],[286],{"type":27,"value":287},"sentinelone-process-graph.jpg",{"type":22,"tag":80,"props":289,"children":290},{},[291],{"type":27,"value":292},"Singularity XDR Process Graph — process execution flow and connections",{"type":22,"tag":80,"props":294,"children":295},{},[296],{"type":22,"tag":30,"props":297,"children":300},{"href":298,"rel":299},"https:\u002F\u002Fwww.sentinelone.com\u002Fblog\u002Fintroducing-the-new-singularity-xdr-process-graph\u002F",[102],[301],{"type":27,"value":302},"SentinelOne blog",{"type":22,"tag":53,"props":304,"children":305},{},[306,315,320],{"type":22,"tag":80,"props":307,"children":308},{},[309],{"type":22,"tag":84,"props":310,"children":312},{"className":311},[],[313],{"type":27,"value":314},"sentinelone-process-graph-events.png",{"type":22,"tag":80,"props":316,"children":317},{},[318],{"type":27,"value":319},"Process Graph paired with its events table (graph + tabular record together)",{"type":22,"tag":80,"props":321,"children":322},{},[323],{"type":27,"value":127},{"type":22,"tag":53,"props":325,"children":326},{},[327,336,341],{"type":22,"tag":80,"props":328,"children":329},{},[330],{"type":22,"tag":84,"props":331,"children":333},{"className":332},[],[334],{"type":27,"value":335},"sentinelone-storyline-wastedlocker.png",{"type":22,"tag":80,"props":337,"children":338},{},[339],{"type":27,"value":340},"Storyline view of the WastedLocker ransomware chain, surfacing behaviors the raw OS event view misses",{"type":22,"tag":80,"props":342,"children":343},{},[344],{"type":27,"value":127},{"type":22,"tag":39,"props":346,"children":348},{"id":347},"wiz-security-graph",[349],{"type":27,"value":16},{"type":22,"tag":45,"props":351,"children":352},{},[353,371],{"type":22,"tag":49,"props":354,"children":355},{},[356],{"type":22,"tag":53,"props":357,"children":358},{},[359,363,367],{"type":22,"tag":57,"props":360,"children":361},{},[362],{"type":27,"value":61},{"type":22,"tag":57,"props":364,"children":365},{},[366],{"type":27,"value":66},{"type":22,"tag":57,"props":368,"children":369},{},[370],{"type":27,"value":71},{"type":22,"tag":73,"props":372,"children":373},{},[374,401],{"type":22,"tag":53,"props":375,"children":376},{},[377,386,391],{"type":22,"tag":80,"props":378,"children":379},{},[380],{"type":22,"tag":84,"props":381,"children":383},{"className":382},[],[384],{"type":27,"value":385},"wiz-attack-path-analysis.png",{"type":22,"tag":80,"props":387,"children":388},{},[389],{"type":27,"value":390},"Attack path visualization — CVE + brute-force findings chained to data access",{"type":22,"tag":80,"props":392,"children":393},{},[394],{"type":22,"tag":30,"props":395,"children":398},{"href":396,"rel":397},"https:\u002F\u002Fdocs.cloud.google.com\u002Farchitecture\u002Fpartners\u002Fid-prioritize-security-risks-with-wiz",[102],[399],{"type":27,"value":400},"Google Cloud architecture docs",{"type":22,"tag":53,"props":402,"children":403},{},[404,413,418],{"type":22,"tag":80,"props":405,"children":406},{},[407],{"type":22,"tag":84,"props":408,"children":410},{"className":409},[],[411],{"type":27,"value":412},"wiz-security-graph-log4j.png",{"type":22,"tag":80,"props":414,"children":415},{},[416],{"type":27,"value":417},"Security Graph of cloud resources associated with a Log4j vulnerability",{"type":22,"tag":80,"props":419,"children":420},{},[421],{"type":27,"value":127},{"type":22,"tag":39,"props":423,"children":425},{"id":424},"not-captured",[426],{"type":27,"value":17},{"type":22,"tag":428,"props":429,"children":430},"ul",{},[431,452],{"type":22,"tag":432,"props":433,"children":434},"li",{},[435,441,443,450],{"type":22,"tag":436,"props":437,"children":438},"strong",{},[439],{"type":27,"value":440},"CrowdStrike Falcon incident graph",{"type":27,"value":442}," — public material is video-only (",{"type":22,"tag":30,"props":444,"children":447},{"href":445,"rel":446},"https:\u002F\u002Fwww.crowdstrike.com\u002Ftech-hub\u002Fendpoint-security\u002Ffalcon-insight-xdr-walkthrough\u002F",[102],[448],{"type":27,"value":449},"Falcon Insight XDR walkthrough",{"type":27,"value":451},"); console screenshots sit behind the customer portal.",{"type":22,"tag":432,"props":453,"children":454},{},[455,460,462,469],{"type":22,"tag":436,"props":456,"children":457},{},[458],{"type":27,"value":459},"Cortex XDR Causality View",{"type":27,"value":461}," — docs pages render images behind scripts\u002FWAF (fetch attempts 403'd); see the ",{"type":22,"tag":30,"props":463,"children":466},{"href":464,"rel":465},"https:\u002F\u002Fdocs-cortex.paloaltonetworks.com\u002Fr\u002FCortex-XDR\u002FCortex-XDR-3.x-Documentation\u002FCausality-view",[102],[467],{"type":27,"value":468},"Causality View doc",{"type":27,"value":470}," for the textual description used in the survey.",1794599463208]