> For the complete documentation index, see [llms.txt](https://docs.alpha-security.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.alpha-security.app/user-guide/graph.md).

# Graph & Attack Paths

The graph gives you a visual map of everything Alpha knows about the target environment. Hosts, services, credentials, and their relationships are rendered as an interactive node-link diagram.

## What's on the graph

Nodes represent entities: hosts, services, web endpoints, credentials, identities, shares. Edges represent relationships: a host exposes a service, a credential grants access to a host, a service hosts an endpoint.

As you capture more data, the graph fills in automatically. Run nmap and you get hosts and services. Run netexec and those hosts gain credential edges. Each piece of evidence adds to the picture.

## Navigation

* **Zoom and pan** with the mouse wheel and drag
* **Click a node** to see its details: properties, linked evidence, and connected entities
* **Search** to highlight specific nodes by name, IP, or kind

## High-value targets

The graph highlights high-value nodes: domain controllers, database servers, hosts with many credential relationships. These stand out visually so you can spot important targets quickly.

## Attack paths

Alpha can compute and highlight attack paths between nodes. Select a source and destination to see the shortest path through the credential and access graph. This helps you identify and document lateral movement chains.

## Active Directory import

If you've collected AD data with SharpHound or BloodHound.py, you can import the JSON files into Alpha's graph. The import merges Active Directory relationships (group memberships, admin rights, sessions) with Alpha's evidence-backed entities, giving you one combined view.

Import AD JSON files through the **Graph > Import** menu in the web UI.

## Layout

The graph uses a force-directed layout by default. The control panel on the left lets you filter by node kind, toggle edge types, and adjust the layout. You can also switch to hierarchical layout for more structured views.