[{"data":1,"prerenderedAt":697},["ShallowReactive",2],{"cycle-doc-bob-wire-c18-precedents.md":3},{"cycle":4,"project":7,"path":10,"title":11,"toc":12,"ast":19},{"id":5,"title":6},"c18","Post-Mortem Map",{"id":8,"label":9},"bob-wire","Bob-Wire","precedents.md","Post-Mortem Map — Precedent Research",[13,14,15,16,17,18],"Short answer","Precedent survey","What the map does that a table\u002Ftimeline can't","What the map does badly","Gut-check verdict","Sources",{"type":20,"children":21},"root",[22,39,48,53,72,78,105,110,117,136,161,167,193,216,222,255,261,280,286,298,304,316,322,341,346,351,402,407,412,464,469,486,491,538,543],{"type":23,"tag":24,"props":25,"children":26},"element","p",{},[27,30,37],{"type":28,"value":29},"text","Research pass answering the open question from ",{"type":23,"tag":31,"props":32,"children":34},"a",{"href":33},"\u002Fcycles\u002Fbob-wire\u002Fc18\u002Fdoc\u002Finitial-prompt",[35],{"type":28,"value":36},"initial-prompt.md",{"type":28,"value":38},":",{"type":23,"tag":40,"props":41,"children":42},"blockquote",{},[43],{"type":23,"tag":24,"props":44,"children":45},{},[46],{"type":28,"value":47},"What is the value of a visual map really? Are we just looking for a problem to fit our solution? Are there existing precedents?",{"type":23,"tag":24,"props":49,"children":50},{},[51],{"type":28,"value":52},"Date: 2026-07-24. Sources at the bottom.",{"type":23,"tag":24,"props":54,"children":55},{},[56,62,64,70],{"type":23,"tag":57,"props":58,"children":59},"strong",{},[60],{"type":28,"value":61},"Screenshots:",{"type":28,"value":63}," product screenshots of these precedents are in ",{"type":23,"tag":31,"props":65,"children":67},{"href":66},"\u002Fcycles\u002Fbob-wire\u002Fc18\u002Fdoc\u002Fprecedents\u002FREADME",[68],{"type":28,"value":69},"precedents\u002F",{"type":28,"value":71}," (Defender attack story GIFs, Detective finding-group graph, SentinelOne Process Graph, Wiz attack paths).",{"type":23,"tag":73,"props":74,"children":76},"h2",{"id":75},"short-answer",[77],{"type":28,"value":13},{"type":23,"tag":24,"props":79,"children":80},{},[81,83,88,90,96,98,103],{"type":28,"value":82},"Yes, there are strong precedents — an entity\u002Factor graph on an incident page is an ",{"type":23,"tag":57,"props":84,"children":85},{},[86],{"type":28,"value":87},"industry-standard pattern",{"type":28,"value":89},", shipped by Microsoft, AWS, Wiz, SentinelOne, CrowdStrike, and Palo Alto in exactly the position c18 proposes: on the incident detail page, alongside (never instead of) tables and timelines. We are not inventing a problem. The honest caveats are about ",{"type":23,"tag":91,"props":92,"children":93},"em",{},[94],{"type":28,"value":95},"when",{"type":28,"value":97}," the map earns its place and ",{"type":23,"tag":91,"props":99,"children":100},{},[101],{"type":28,"value":102},"what it must not pretend to know",{"type":28,"value":104}," — captured in the verdict section.",{"type":23,"tag":73,"props":106,"children":108},{"id":107},"precedent-survey",[109],{"type":28,"value":14},{"type":23,"tag":111,"props":112,"children":114},"h3",{"id":113},"microsoft-defender-xdr-attack-story-incident-graph",[115],{"type":28,"value":116},"Microsoft Defender XDR — \"Attack story\" \u002F incident graph",{"type":23,"tag":24,"props":118,"children":119},{},[120,122,127,129,134],{"type":28,"value":121},"The closest precedent to the c18 concept. When an analyst opens an incident, the ",{"type":23,"tag":57,"props":123,"children":124},{},[125],{"type":28,"value":126},"attack story view is the centerpiece",{"type":28,"value":128}," of the investigation page: an interactive graph connecting the suspicious entities of the attack to their related assets — users, devices, mailboxes, applications. The root node on the left is initial access; branches to the right show lateral movement and impact. Analysts can click any node for entity details and take remediation actions directly from the graph, and can ",{"type":23,"tag":57,"props":130,"children":131},{},[132],{"type":28,"value":133},"\"play\" the alerts chronologically",{"type":28,"value":135}," to watch the attack unfold over time.",{"type":23,"tag":137,"props":138,"children":139},"ul",{},[140,146,151,156],{"type":23,"tag":141,"props":142,"children":143},"li",{},[144],{"type":28,"value":145},"Nodes: entities + assets (user, device, mailbox, app, file, process)",{"type":23,"tag":141,"props":147,"children":148},{},[149],{"type":28,"value":150},"Edges: attack relationships (\"spread to\", \"accessed\", \"sent\")",{"type":23,"tag":141,"props":152,"children":153},{},[154],{"type":28,"value":155},"Time: handled with a play\u002Fscrub affordance layered on the graph, not encoded in layout alone",{"type":23,"tag":141,"props":157,"children":158},{},[159],{"type":28,"value":160},"Position in workflow: incident page centerpiece, used for both triage and retrospective understanding",{"type":23,"tag":111,"props":162,"children":164},{"id":163},"amazon-guardduty-detective-finding-groups-behavior-graph",[165],{"type":28,"value":166},"Amazon GuardDuty + Detective — finding groups \u002F behavior graph",{"type":23,"tag":24,"props":168,"children":169},{},[170,172,177,179,184,186,191],{"type":28,"value":171},"Detective builds a ",{"type":23,"tag":57,"props":173,"children":174},{},[175],{"type":28,"value":176},"behavior graph",{"type":28,"value":178}," from up to a year of historical activity and renders each ",{"type":23,"tag":57,"props":180,"children":181},{},[182],{"type":28,"value":183},"finding group",{"type":28,"value":185}," (a correlated cluster of findings + resources belonging to one security event) as an interactive graph of \"the events, resources, and security findings that make up an event.\" Explicitly pitched at ",{"type":23,"tag":57,"props":187,"children":188},{},[189],{"type":28,"value":190},"root-cause analysis after detection",{"type":28,"value":192}," — the most post-mortem-flavored precedent. GuardDuty attack sequences pivot directly into it.",{"type":23,"tag":137,"props":194,"children":195},{},[196,201,206,211],{"type":23,"tag":141,"props":197,"children":198},{},[199],{"type":28,"value":200},"Nodes: AWS resources, principals, findings",{"type":23,"tag":141,"props":202,"children":203},{},[204],{"type":28,"value":205},"Edges: observed relationships and actions between them",{"type":23,"tag":141,"props":207,"children":208},{},[209],{"type":28,"value":210},"Time: separate activity-volume timeline views over a selected window",{"type":23,"tag":141,"props":212,"children":213},{},[214],{"type":28,"value":215},"Position in workflow: investigation\u002Froot-cause, after the alert — closest to a post-mortem context",{"type":23,"tag":111,"props":217,"children":219},{"id":218},"wiz-security-graph-attack-path-analysis",[220],{"type":28,"value":221},"Wiz — Security Graph \u002F attack path analysis",{"type":23,"tag":24,"props":223,"children":224},{},[225,227,232,234,239,241,246,248,253],{"type":28,"value":226},"A different genus worth distinguishing: Wiz's graph models the ",{"type":23,"tag":57,"props":228,"children":229},{},[230],{"type":28,"value":231},"standing state of the environment",{"type":28,"value":233}," (nodes = identities, workloads, policies; edges = \"can assume\", \"is exposed to internet\", \"has access to\", \"contains\") rather than a specific incident's event history. Attack paths are traversals over that state. Relevant to c18 because it proves the value of ",{"type":23,"tag":57,"props":235,"children":236},{},[237],{"type":28,"value":238},"state on the map",{"type":28,"value":240}," — a node being internet-exposed or a bucket containing PII is exactly the \"sensitive file \u002F dis-allowed MCP server\" overlay in the c18 prompt. But it visualizes ",{"type":23,"tag":91,"props":242,"children":243},{},[244],{"type":28,"value":245},"potential",{"type":28,"value":247}," paths, not ",{"type":23,"tag":91,"props":249,"children":250},{},[251],{"type":28,"value":252},"what happened",{"type":28,"value":254},".",{"type":23,"tag":111,"props":256,"children":258},{"id":257},"sentinelone-storyline-singularity-process-graph",[259],{"type":28,"value":260},"SentinelOne — Storyline \u002F Singularity Process Graph",{"type":23,"tag":24,"props":262,"children":263},{},[264,266,271,273,278],{"type":28,"value":265},"Every event the agent captures is tagged with a ",{"type":23,"tag":57,"props":267,"children":268},{},[269],{"type":28,"value":270},"Storyline ID",{"type":28,"value":272}," that flows from the first suspicious process through every child process, thread injection, file drop, and network call. The Process Graph renders that chain from initial execution through MITRE ATT&CK classification. Notably, SentinelOne ",{"type":23,"tag":57,"props":274,"children":275},{},[276],{"type":28,"value":277},"pairs the graph with a timeline view",{"type":28,"value":279}," — the graph carries structure (parent\u002Fchild, injections), the timeline carries sequence.",{"type":23,"tag":111,"props":281,"children":283},{"id":282},"crowdstrike-falcon-incident-graph-view",[284],{"type":28,"value":285},"CrowdStrike Falcon — incident graph view",{"type":23,"tag":24,"props":287,"children":288},{},[289,291,296],{"type":28,"value":290},"Incident page offers a graph view where analysts add data elements progressively and click process nodes for command lines and process genealogy. Pattern of note: the graph ",{"type":23,"tag":57,"props":292,"children":293},{},[294],{"type":28,"value":295},"starts small and grows on demand",{"type":28,"value":297}," rather than rendering everything — an answer to the hairball problem.",{"type":23,"tag":111,"props":299,"children":301},{"id":300},"palo-alto-cortex-xdr-causality-view",[302],{"type":28,"value":303},"Palo Alto Cortex XDR — Causality View",{"type":23,"tag":24,"props":305,"children":306},{},[307,309,314],{"type":28,"value":308},"Renders the ",{"type":23,"tag":57,"props":310,"children":311},{},[312],{"type":28,"value":313},"entire process execution chain that led up to an alert",{"type":28,"value":315},", with per-node context. The name is the honest part: it only draws edges the agent actually observed (process spawned process), which is why it can call itself a causality view. Edges that are merely temporal or inferred don't get drawn as causal.",{"type":23,"tag":111,"props":317,"children":319},{"id":318},"ai-agent-specific-precedents-emerging-no-dominant-player",[320],{"type":28,"value":321},"AI-agent-specific precedents (emerging, no dominant player)",{"type":23,"tag":24,"props":323,"children":324},{},[325,327,332,334,339],{"type":28,"value":326},"Agent observability tools (e.g., Galileo's Agent Graph, MCP tracing tools) are starting to render ",{"type":23,"tag":57,"props":328,"children":329},{},[330],{"type":28,"value":331},"agent trace graphs",{"type":28,"value":333}," — paths through multi-agent reasoning loops, MCP client\u002Fserver call hierarchies. MCP security vendors (Nightfall et al.) inventory MCP servers and scan tool calls but present results as tables\u002Falerts, not incident maps. ",{"type":23,"tag":57,"props":335,"children":336},{},[337],{"type":28,"value":338},"Nobody owns \"the post-mortem map of an agent incident\" yet",{"type":28,"value":340}," — actors like MCP servers, repos, and model endpoints with policy-state overlays (dis-allowed, sensitive) are not a picture any incumbent draws today. That's the differentiated part of c18; the interaction pattern itself is well-proven.",{"type":23,"tag":73,"props":342,"children":344},{"id":343},"what-the-map-does-that-a-tabletimeline-cant",[345],{"type":28,"value":15},{"type":23,"tag":24,"props":347,"children":348},{},[349],{"type":28,"value":350},"Consistent across precedents:",{"type":23,"tag":352,"props":353,"children":354},"ol",{},[355,365,382,392],{"type":23,"tag":141,"props":356,"children":357},{},[358,363],{"type":23,"tag":57,"props":359,"children":360},{},[361],{"type":28,"value":362},"Scope \u002F blast radius at a glance",{"type":28,"value":364}," — \"how far did this go\" is a shape question. Defender sells the graph as showing \"the full scope of the attack\"; Detective as \"the scope of the incident and all affected resources.\"",{"type":23,"tag":141,"props":366,"children":367},{},[368,373,375,380],{"type":23,"tag":57,"props":369,"children":370},{},[371],{"type":28,"value":372},"Paths, not just participants",{"type":28,"value":374}," — a table lists actors; only the graph shows ",{"type":23,"tag":91,"props":376,"children":377},{},[378],{"type":28,"value":379},"how",{"type":28,"value":381}," the incident moved between them (agent → MCP server → file → external endpoint). This is the exfiltration-path story.",{"type":23,"tag":141,"props":383,"children":384},{},[385,390],{"type":23,"tag":57,"props":386,"children":387},{},[388],{"type":28,"value":389},"Fusing many alerts into one incident picture",{"type":28,"value":391}," — when one incident spans multiple findings, the graph is the join surface (Detective finding groups, Defender incidents).",{"type":23,"tag":141,"props":393,"children":394},{},[395,400],{"type":23,"tag":57,"props":396,"children":397},{},[398],{"type":28,"value":399},"State anchored to actors",{"type":28,"value":401}," — badges on nodes (Wiz's exposed\u002FPII, our sensitive\u002Fdis-allowed) read faster than a state column scanned across rows.",{"type":23,"tag":73,"props":403,"children":405},{"id":404},"what-the-map-does-badly",[406],{"type":28,"value":16},{"type":23,"tag":24,"props":408,"children":409},{},[410],{"type":28,"value":411},"Equally consistent:",{"type":23,"tag":352,"props":413,"children":414},{},[415,425,435,445],{"type":23,"tag":141,"props":416,"children":417},{},[418,423],{"type":23,"tag":57,"props":419,"children":420},{},[421],{"type":28,"value":422},"Sequence.",{"type":28,"value":424}," Every serious precedent pairs the graph with a timeline or a play control. Layout position is a bad encoding for time. If the incident story is \"then, then, then,\" a timeline\u002Fevent chain wins.",{"type":23,"tag":141,"props":426,"children":427},{},[428,433],{"type":23,"tag":57,"props":429,"children":430},{},[431],{"type":28,"value":432},"Density.",{"type":28,"value":434}," Graphs hairball beyond a few dozen nodes. CrowdStrike's answer is progressive disclosure; Defender's is grouping related assets. A post-mortem map must be curated to the incident's actors, not the whole environment.",{"type":23,"tag":141,"props":436,"children":437},{},[438,443],{"type":23,"tag":57,"props":439,"children":440},{},[441],{"type":28,"value":442},"Implied causality.",{"type":28,"value":444}," A drawn edge reads as \"this caused that.\" Cortex XDR earns its edges from observed process ancestry. If our telemetry only supports \"these two events were in the same session,\" drawing a solid arrow between them is a lie. Observed vs inferred must be visually distinct.",{"type":23,"tag":141,"props":446,"children":447},{},[448,453,455,462],{"type":23,"tag":57,"props":449,"children":450},{},[451],{"type":28,"value":452},"Small incidents.",{"type":28,"value":454}," With 2–3 actors, a card layout (see ",{"type":23,"tag":456,"props":457,"children":459},"code",{"className":458},[],[460],{"type":28,"value":461},"app\u002Fpages\u002Fc13\u002Fwireframes\u002Fwf1\u002Fai-agent-policies-v1\u002Fviolation.vue",{"type":28,"value":463}," — Source\u002FTarget actor cards) delivers the same comprehension with less machinery.",{"type":23,"tag":73,"props":465,"children":467},{"id":466},"gut-check-verdict",[468],{"type":28,"value":17},{"type":23,"tag":24,"props":470,"children":471},{},[472,477,479,484],{"type":23,"tag":57,"props":473,"children":474},{},[475],{"type":28,"value":476},"The map is justified, with conditions.",{"type":28,"value":478}," It is not a solution looking for a problem — six major security products put an actor graph on the incident page, and post-incident comprehension (Detective, Defender's play-back) is an established use, not just live triage. The specific c18 framing — agent incidents whose actors are users, agents, MCP servers, files, repos, and model endpoints, with policy state overlaid — has ",{"type":23,"tag":57,"props":480,"children":481},{},[482],{"type":28,"value":483},"no incumbent precedent",{"type":28,"value":485},", which makes it worth prototyping.",{"type":23,"tag":24,"props":487,"children":488},{},[489],{"type":28,"value":490},"Conditions the brief must carry:",{"type":23,"tag":137,"props":492,"children":493},{},[494,506,518,528],{"type":23,"tag":141,"props":495,"children":496},{},[497,499,504],{"type":28,"value":498},"The map is the ",{"type":23,"tag":57,"props":500,"children":501},{},[502],{"type":28,"value":503},"orientation layer",{"type":28,"value":505},", not the record. It sits at the top of the incident page and answers \"what happened, who was involved, what state were they in\" in seconds; tables\u002Ftimeline below remain the evidence.",{"type":23,"tag":141,"props":507,"children":508},{},[509,511,516],{"type":28,"value":510},"It earns its place when the incident has ",{"type":23,"tag":57,"props":512,"children":513},{},[514],{"type":28,"value":515},"roughly four or more actors across two or more types, and the path between them is the story",{"type":28,"value":517},". The brief should not force a map onto incidents that are a single actor doing one bad thing.",{"type":23,"tag":141,"props":519,"children":520},{},[521,526],{"type":23,"tag":57,"props":522,"children":523},{},[524],{"type":28,"value":525},"Sequence lives in a timeline companion",{"type":28,"value":527},", not in graph layout. The map may number its edges or offer step-through, but the linear record is a separate element.",{"type":23,"tag":141,"props":529,"children":530},{},[531,536],{"type":23,"tag":57,"props":532,"children":533},{},[534],{"type":28,"value":535},"Observed vs inferred edges are visually distinct",{"type":28,"value":537},", and no edge is drawn that telemetry can't support (c15 \"do NOT invent\" rule).",{"type":23,"tag":73,"props":539,"children":541},{"id":540},"sources",[542],{"type":28,"value":18},{"type":23,"tag":137,"props":544,"children":545},{},[546,557,567,577,587,597,607,617,627,637,647,657,667,677,687],{"type":23,"tag":141,"props":547,"children":548},{},[549],{"type":23,"tag":31,"props":550,"children":554},{"href":551,"rel":552},"https:\u002F\u002Ftechcommunity.microsoft.com\u002Fblog\u002Fmicrosoftthreatprotectionblog\u002Finvestigate-incidents-more-effectively-with-the-new-attack-story-view-in-microso\u002F3670478",[553],"nofollow",[555],{"type":28,"value":556},"Investigate incidents more effectively with the new attack story view in Microsoft 365 Defender",{"type":23,"tag":141,"props":558,"children":559},{},[560],{"type":23,"tag":31,"props":561,"children":564},{"href":562,"rel":563},"https:\u002F\u002Ftechcommunity.microsoft.com\u002Ft5\u002Fmicrosoft-defender-xdr-blog\u002Fnew-incident-graph-view-in-microsoft-365-defender\u002Fba-p\u002F2710668",[553],[565],{"type":28,"value":566},"New Incident Graph view in Microsoft 365 Defender",{"type":23,"tag":141,"props":568,"children":569},{},[570],{"type":23,"tag":31,"props":571,"children":574},{"href":572,"rel":573},"https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fdefender-xdr\u002Funderstand-graph-icons",[553],[575],{"type":28,"value":576},"Graph icons and visualizations in Microsoft Defender",{"type":23,"tag":141,"props":578,"children":579},{},[580],{"type":23,"tag":31,"props":581,"children":584},{"href":582,"rel":583},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fdetective\u002Flatest\u002Fuserguide\u002Fwhat-is-detective.html",[553],[585],{"type":28,"value":586},"What is Amazon Detective?",{"type":23,"tag":141,"props":588,"children":589},{},[590],{"type":23,"tag":31,"props":591,"children":594},{"href":592,"rel":593},"https:\u002F\u002Faws.amazon.com\u002Fabout-aws\u002Fwhats-new\u002F2023\u002F03\u002Famazon-detective-graph-visualization-interactive-security-investigations",[553],[595],{"type":28,"value":596},"Amazon Detective graph visualization for interactive security investigations",{"type":23,"tag":141,"props":598,"children":599},{},[600],{"type":23,"tag":31,"props":601,"children":604},{"href":602,"rel":603},"https:\u002F\u002Fdocs.aws.amazon.com\u002Fdetective\u002Flatest\u002Fuserguide\u002Fdetective-investigation-about.html",[553],[605],{"type":28,"value":606},"How Detective is used for investigation",{"type":23,"tag":141,"props":608,"children":609},{},[610],{"type":23,"tag":31,"props":611,"children":614},{"href":612,"rel":613},"https:\u002F\u002Fwww.wiz.io\u002Flp\u002Fwiz-security-graph",[553],[615],{"type":28,"value":616},"Wiz Security Graph: How It Works",{"type":23,"tag":141,"props":618,"children":619},{},[620],{"type":23,"tag":31,"props":621,"children":624},{"href":622,"rel":623},"https:\u002F\u002Fwww.wiz.io\u002Facademy\u002Fdetection-and-response\u002Fattack-path-analysis",[553],[625],{"type":28,"value":626},"What is Attack Path Analysis? — Wiz",{"type":23,"tag":141,"props":628,"children":629},{},[630],{"type":23,"tag":31,"props":631,"children":634},{"href":632,"rel":633},"https:\u002F\u002Fwww.wiz.io\u002Fblog\u002Fwiz-security-graph-enhances-cloud-incident-response",[553],[635],{"type":28,"value":636},"Wiz Security Graph offers root cause analysis for cloud IR",{"type":23,"tag":141,"props":638,"children":639},{},[640],{"type":23,"tag":31,"props":641,"children":644},{"href":642,"rel":643},"https:\u002F\u002Fwww.sentinelone.com\u002Fblog\u002Fintroducing-the-new-singularity-xdr-process-graph\u002F",[553],[645],{"type":28,"value":646},"Introducing the New Singularity XDR Process Graph — SentinelOne",{"type":23,"tag":141,"props":648,"children":649},{},[650],{"type":23,"tag":31,"props":651,"children":654},{"href":652,"rel":653},"https:\u002F\u002Fwww.sentinelone.com\u002Fblog\u002Frapid-threat-hunting-with-deep-visibility-feature-spotlight\u002F",[553],[655],{"type":28,"value":656},"Rapid Threat Hunting with Storylines — SentinelOne",{"type":23,"tag":141,"props":658,"children":659},{},[660],{"type":23,"tag":31,"props":661,"children":664},{"href":662,"rel":663},"https:\u002F\u002Fwww.crowdstrike.com\u002Ftech-hub\u002Fendpoint-security\u002Ffalcon-insight-xdr-walkthrough\u002F",[553],[665],{"type":28,"value":666},"CrowdStrike Falcon Insight XDR Walkthrough",{"type":23,"tag":141,"props":668,"children":669},{},[670],{"type":23,"tag":31,"props":671,"children":674},{"href":672,"rel":673},"https:\u002F\u002Fdocs-cortex.paloaltonetworks.com\u002Fr\u002FCortex-XDR\u002FCortex-XDR-3.x-Documentation\u002FCausality-view",[553],[675],{"type":28,"value":676},"Causality View — Cortex XDR",{"type":23,"tag":141,"props":678,"children":679},{},[680],{"type":23,"tag":31,"props":681,"children":684},{"href":682,"rel":683},"https:\u002F\u002Farize.com\u002Fblog\u002Fbest-ai-observability-tools-for-autonomous-agents-in-2026\u002F",[553],[685],{"type":28,"value":686},"Best AI Observability Tools for Autonomous Agents in 2026 — Arize",{"type":23,"tag":141,"props":688,"children":689},{},[690],{"type":23,"tag":31,"props":691,"children":694},{"href":692,"rel":693},"https:\u002F\u002Fwww.integrate.io\u002Fblog\u002Fbest-mcp-gateways-and-ai-agent-security-tools\u002F",[553],[695],{"type":28,"value":696},"Best MCP Gateways and AI Agent Security Tools (2026)",1794599415981]