Skip to main content

Analysis and sharing

The Analysis tab under a parsed diagram holds two views that read the topology, the control mappings and the evidence together: a coverage heatmap and the attack paths. The Export menu is how the diagram and its analysis leave the platform, with redaction for anything shared outside.

Coverage heatmap​

Coverage Heatmap scores every node on how well it is covered: whether it has control mappings and how many are confirmed, how strong its linked evidence is, and whether unacknowledged attack paths run through it (with extra weight if it is an entry point or a target). The panel shows the overall score, counts of nodes with controls, with evidence, and in attack paths, and a distribution across five levels: critical risk, low, medium, good and excellent coverage.

Show paints the levels onto the diagram itself. Below, nodes are grouped by level, worst first, each with its confirmed-over-total controls, its evidence percentage and how many attack paths touch it; entry points and targets are marked. The heatmap exports as CSV or JSON.

Attack paths​

Attack path analysis looks for routes from where an attacker could start (the internet, external systems, clients and users, VPNs, mobile devices, and anything in a public zone) to what they would want (databases, servers, backup and mail servers, storage, containers, functions). It follows the shortest route up to ten hops, notes where a boundary control is missing along the way and where web traffic reaches a server without a WAF, and scores the path from 0 to 100: what the target is worth, how exposed the entry is, how direct the route is, how many zones it crosses, what is missing, and what is present to its credit. From 80 is critical, from 60 high, from 40 medium.

Analysis runs after parsing; Analyze runs it again. Each path opens to its description, a Why this score breakdown where every factor traces to a fact on the path, the traversal with zone transitions, the controls missing and present, and suggested mitigations. Show Path traces it on the diagram. Acknowledge records that you have reviewed it, with optional notes, and hides it from the default view; acknowledged paths no longer count against coverage, and Reopen brings one back.

Diagrams generated from a cloud account carry the provider's own direction on every connection, so paths there are directional. Uploaded diagrams are analyzed as if connections ran both ways, since the drawing's arrow direction is not reliable.

Exports​

The Export menu on the Topology tab:

  • Copy Mermaid Code for the diagram source.
  • Export as JSON and Export as Mermaid, for approved diagrams: the stored artifacts, served through a link that expires after an hour.
  • Export Draft JSON for a diagram not yet approved.
  • Import JSON replaces the working topology with a file you exported earlier.
  • Generate Compliance Report: one JSON file with the sections you choose (topology, control mappings, attack paths, coverage heatmap, evidence links); sections with no data are marked.

The Controls Summary, Coverage Heatmap and Attack Path Analysis panels each export their own data as CSV or JSON.

Redact and share​

Redact & Share prepares a copy for people outside your organization without touching the original. Rules cover IP addresses, hostnames, port numbers, zone names and any custom string or pattern you add; each rule uses a strategy: mask with asterisks, replace with a placeholder, replace with a short consistent hash, or replace with generic sequential labels (Server-1, Server-2). IP addresses and hostnames are redacted by default. Global toggles decide whether node labels, connection labels and zone names are processed at all.

Show Preview lists what will change, original to redacted. Then Copy Mermaid, Export .mmd or Export JSON. The redacted copy is marked as redacted, with the configuration name you gave it.