PyGraphistry: Graph analytics for threat detection in enterprise data

Researchers published a complete workflow on PyGraphistry — an open-source graph analytics tool — for detecting anomalies and investigating incidents in corporate access data. The pipeline runs directly in Colab and doesn't require complex infrastructure.

Where the data comes from

At the core of the workflow is a synthetic dataset that mimics a real corporate environment. It contains five entities: users, devices, IP addresses, services, and roles — additionally marked with geolocation. From this data, a graph is built: user → device → IP → service forms a chain of nodes and edges. The synthetic set allows the pipeline to be tested without using real corporate data. Yet the structure is intentionally close to what is found in corporate SIEM systems and Active Directory logs.

What happens to the graph

After building the basic structure, the graph is enriched with several layers of analytics:

• Risk scores — numerical assessment of danger for each node based on its properties and connections
• Centrality metrics — PageRank, betweenness centrality, and other indicators of node weight in the network
• Community detection — algorithm automatically groups nodes into clusters
• Isolation Forest — ML algorithm for detecting anomalous nodes: those that are hardest to isolate in a random tree get a high anomaly score
• UMAP layout — nonlinear dimensionality reduction that compactly places similar objects nearby

Each layer adds an attribute to nodes and edges and is visible in the interactive visualization as color, size, or tooltip.

Three visualization modes

PyGraphistry together with PyVis creates three views of the same graph. The full graph shows the entire network of interconnections — devices, users, services, and IP addresses — and is used for initial overview. The analyst immediately sees which nodes form dense clusters and which stand apart.

The ego-graph focuses on a specific node and its immediate surroundings. This is the key mode for investigation: when suspicion falls on a specific user or IP address, the ego-graph shows all direct and indirect connections of the object without extra noise. The high-risk view filters only nodes with high danger scores — those where Isolation Forest detected deviation from the norm. This reduces investigation space by orders of magnitude: instead of thousands of objects, the analyst works with dozens.

Why graph approach is important for security

Traditional analysis in SIEM works with flat event tables: row by row, event by event. This makes complex multi-stage attacks difficult to detect because each individual event looks harmless. Graph flips the logic: instead of temporal sequence, the analyst sees network structure. An attack path — a chain of nodes with anomalous connections — becomes visually apparent. Combined with Isolation Forest, the anomaly is visible not just as a numerical outlier, but as a visually isolated or overly connected node on the graph.

What this means

Graph analytics for cybersecurity has long remained the domain of expensive commercial platforms. An open workflow on PyGraphistry lowers the entry threshold: small security teams get a ready-made tool that can be adapted to real Active Directory logs or CloudTrail.