Linkurious Enterprise 2.7: automate your investigation workflows with query templates

We are happy to share that a new beta release of Linkurious Enterprise is available. This new version ships with the second iteration of the Query Template that lets you turn repetitive investigation workflows into simple forms or buttons. We redesigned the query panel to improve the investigation experience. This release also brings support for Docker container deployment and Neo4j 3.5 Search.

This post covers the following items:

• New options to customize your query templates;
• Revamped query panel + new query preview;
• Update on the query management rights;
• Support for Docker 📦;
• Support for Neo4j 3.5 Search 🔍;
• Additional improvements: layout, histogram, and Excel export

The first iteration of the Query Templates in Linkurious Enterprise let you create and share queries that can be run from a right-click on a node. This new version of the Query Template lets you create and share custom-made workflows to enhance investigators capacities. Query Templates now go beyond single-node input. In 2.7, you can:

• create templates with two-nodes inputs;
• create templates with write instructions;
• create templates with new types of inputs;
• run templates on multiple nodes at once;
• use built-in templates.

The Query Templates can now take two nodes, instead of one, as inputs. This allows you to create and save custom investigation workflows, such as custom shortest paths, as buttons or forms. For instance, you can build a template that searches for the shortest path between two nodes but only through edges of a certain type, and in a given number of hops. The “UBO (Ultimate Beneficial Owner) Path” Query Template in the example below searches for a path connecting:

• a business owner with a company
• only through shareholding connections with property “shares” greater than 20%
• with a minimum of 4 hops between them.

In the investigation interface, it is straightforward for users to apply this custom-made workflow on nodes of their choice. They pick the source and destination nodes directly from the investigation workspace and provide the other variables through a form.

This new version of Query Template also lets you create and save templates with write instructions. Either with a single node or two nodes, as inputs, you can set up custom write actions. For example, the query template below takes a node as input and creates two properties. It sets the new “suspicious” property to true and in the “note” property, the user can add a comment when running the query.

Users run write actions on the data in one-click without a line of Cypher, Gremlin or SPARQL. Flagging suspicious nodes, merging duplicates, adding comments: write queries let users enrich data with their findings in autonomy.

In 2.7, new input types are available when creating queries: strings, numbers, dates, date-times, booleans, and enumerations. When running the query, users fill in the inputs, for example, a number of entities, an amount or a time-period, through a simple form.

The query below searches for money transfers between bank accounts, with adjustable parameters regarding properties of the transfer edges: a minimum amount and a time range.

This way, analysts combine their expertise in fraud and threat schemes with analytics tools to detect suspicious patterns.

Another change is that you now have the ability to run a template on multiple nodes at once. Provide a node selection in the investigation workspace and the query will run simultaneously on all the nodes of the selection, saving time during investigations.

To get you started, two built-in Query Templates are available for JanusGraph, JanusGraph on Compose, Cosmos DB, DSE Graph and Neo4j users:

• Find path: takes four inputs in (source node, target node, Maximum path length and Maximum number of paths) and returns one or several paths, if any, between two nodes.
• Expand non-leaf nodes: takes one input (a source node, or a batch of nodes) and returns neighbors of the source that are connected to at least one other node

In Linkurious Enterprise 2.7, we worked on improving the query creation and execution experience. The query management page is now a full-size page, so you can properly manage and see your queries.

When writing a new query in the editor, you now have the option to preview its results in an embedded window. The idea is to give you immediate feedback of what your query will generate, without having to leave the editor interface. In the result preview window, you can expand nodes, open the property panel and search for properties. You can refine your query until the preview displays the desired result.

If you are writing a query template, a dedicated form field appears to let you preview the query result with the input of your choice. If your template contains a “node” input, the field will let you type in and search for a node source. If your template contains a numerical input, the field displays a numerical value selector. If you have multiple inputs in your template, multiple fields will appear.

In the query panel redesign, we provided more granular sharing options to improve the management of queries.

In the previous version, you could share your queries with all the other users. We added the ability to share each query with specific groups of users. From the edition panel of your query, you choose one or multiple user groups to share it with.

There is also a new query permission that can be given to a user group. The “execute existing queries” permission encompasses the previous rights “Run read-queries” and “Run read-queries and write-queries”. Users from this new group will be able to run read-only and write-queries.

Finally, if you have query-writing rights, you can edit a query, or load it in the editor from its detail panel.

To ease the deployment of the application, you can now deploy the Linkurious Enterprise server to the cloud or on-premise inside a Docker container.

On the Cloud, you will be able to deploy to the providers currently supported, such as Amazon Web Service. We are considering adding support for Azure and Google Cloud in the coming months.

You can download the container from your account and upload it to the cloud or on-premise. It is not currently available on Docker Hub or Amazon Marketplace. Refer to the admin documentation for the configuration details.

Another good news for administrators: Linkurious Enterprise now supports Neo4j built-in Search index. Neo4j Search was introduced in Neo4j 3.5, adding full-text indexing and search capabilities to the graph database.

You can configure Neo4j Search as the default search index, removing the need to use ElasticSearch within Linkurious Enterprise. The index will be automatically synchronized when your graph database changes and you will get continuous indexation without additional configuration. It’s extremely fast to set up and it drastically reduces the indexation time for large databases.

We are still working on improving the performances, but we recommend this option for databases up to 10 million nodes.

For this release, we worked on improving our graph layout algorithms. We increased the performances of the force-directed and the hierarchical layout, that are respectively 4 times and 5 times faster now! Both layouts are available in Ogma and Linkurious Enterprise.

While improving the quality of our force-directed layout algorithms, we also improved its quality:  this new version now includes improved node-overlap prevention.

In Linkurious Enterprise, you can export your visualization as an excel file. In version 2.7, we added the possibility to export the node categories and edges types in separate tabs of an Excel file. We hope this will make export files easier to work with.

The next release is already in preparation. We are working on allowing administrators to define their data schema to better handle new data types. 2.8 will also provide a time-bar to represent events and filter the graph. Stay tuned!