Graph Explorer
Overview
Graph Explorer provides a visual representation of the entities and relationships observed across the BlueRock environment.
You can use Graph Explorer to:
Explore relationships between instances, MCP servers, agents, LLMs, and sessions.
Filter the graph to focus on specific entities.
View alerts, events, policy definitions, servers, tools, agents, and hosts.
Inspect entity-specific activity and relationships.
Access reports and executive summaries.
Graph Explorer Navigation
The Graph Explorer page provides summary cards across the top of the page. These cards provide access to key entities and activity in the environment.
The available cards include:
Alerts
Total alert events received from all BlueRock VMs within the selected time range.
Reviewed/Dismissed Alerts
Alerts that have been reviewed or dismissed.
Events
Total events received from all BlueRock Hosts within the specified time range.
Policy Definitions
Policy definitions available in BlueRock.
Servers
MCP server applications.
Skills
Skills loaded and executed by AI agent applications.
Tools
MCP tool calls executed by AI agent applications.
Agents
AI agent applications running on the BlueRock Host or BlueRock Sandbox container.
Hosts
BlueRock Hosts in the environment.
Selecting a card opens the corresponding detailed view.
Explore
The Explore view displays the BlueRock environment as an interactive graph.
The graph can display the following entity types:
Instances
MCP Servers
Agents
LLMs
Sessions
Unconnected
Use the Show options to select the entity types displayed in the graph.
Filter the Graph
Use the Filter field to filter the entities displayed in the graph.
For example:
The syntax can be broken down as follows:
mc
Field used for the first filter condition.
~=
Match operator used to compare the field with the specified value.
'0001'
Value used for the mc condition.
&&
Logical AND operator. Both conditions must be satisfied.
ms.state
Field used for the second filter condition.
==
Equality operator.
'active'
Value used for the ms.state condition.
Therefore, the expression:
filters the graph using both conditions: mc matching 0001 and ms.state equal to active.
Graph Layout
Graph Explorer provides three layout options for organizing the graph:
Tree: Displays entities in a hierarchical layout.
Circle: Arranges connected entities around a circular layout.
Group: Groups entities based on the selected grouping option.
Select a layout to change how the graph is arranged.
Use Re-layout to rearrange the graph using the selected layout.
Tree Layout
Select Tree to display the graph in a hierarchical arrangement.
Circle Layout
Select Circle to arrange the graph in a circular layout.
Group Layout
Select Group to organize entities into groups. The Group by option determines how the entities are grouped.
Time Range
Use the time-range selector to control the time period represented in the graph.
The current interface displays the selected range, such as Last 1 hour.
Ghosts
Use the Ghosts option to control whether ghost entities are displayed in the graph.
Entity Details
Select an entity in the graph to open the Node Details panel.
The information displayed in the panel depends on the selected entity type.
For example, selecting an agent can display:
Agent identifier
ID
Short name
Type
Status
Client component
Created time
Last activity
Available actions
Selecting an LLM can display information such as:
Model
Framework
Node ID
Status
Created time
Last activity
Callers
Requests
Successful requests
Errors
Session Details
You can also view session details by selecting the link between connected entities in the graph.
Select the link between an agent and an LLM to view the session details.
Select the link between an agent and an MCP server to view the session details.
Right-click the link to access available session actions.
The Node Details panel can also provide additional actions for the selected entity, depending on the entity type.
Entity Navigation
Graph Explorer provides navigation between related entities and activity.
Depending on the selected entity or view, available actions can include:
Graph
Trace
View Events
View Trace
These actions allow you to move from an entity or alert to its related graph, trace, or event information.
View Entity Details
Select an entity in the graph to open the Node Details panel.
The panel displays information specific to the selected entity. The information shown depends on the entity type.
For example, an agent can display:
Entity ID
Short Name
Type
Status
Client Component
Created time
Last Activity
An LLM can display information such as:
Model
Framework
Node ID
Status
Created time
Last Activity
Callers
Requests
Success
Errors
Open an Entity Graph
From supported entity views, use Graph to open the selected entity in Graph Explorer.
The graph displays the selected entity and its relationships with other entities in the environment.
For example, selecting Graph for an MCP server displays the server together with related instances and agents.
Open a supported entity view, such as Agents, Tools, or MCP Servers.
Select an entity.
Click Graph.
Review the selected entity and its connected entities.
Open an Entity Trace
From supported entity views, use Trace to view activity associated with the selected entity.
The Trace view displays sessions and interactions associated with the selected entity. For example, an MCP server trace can display interactions, conversation information, statistics, and individual MCP events.
Open a supported entity view.
Select an entity.
Select Trace for the selected entity.
The Trace view opens and displays the sessions associated with the selected entity.
Select a session to view its associated activity.
Use the following tabs to review the session:
Interactions — View the interactions and MCP events associated with the session.
Conversation — View the conversation associated with the session.
Statistics — View session statistics.
Review the available sessions and interactions.
Select an interaction to review its associated event information.
Agents
Selecting Agents from the summary cards opens the Agents view.
The Agents view lists agents discovered in the BlueRock environment.
The view provides:
Agent identifier and name
Associated host
Entity identifier
Component information
Last-seen information
Creation time
Current status
Agents can be displayed with statuses such as ACTIVE or IDLE.
Depending on the agent, the view also provides Graph and Trace actions.
Agent View Controls
Use the available tabs to sort or filter agents:
Newest First
Last Seen
Active
The page also displays the number of agents currently listed.
Tools
Selecting Tools opens the Tools view.
The Tools view lists tools associated with MCP servers and provides information about their current activity.
The page includes a search field that can be used to search tools by:
Name
Description
Server
Each MCP server entry can be expanded to display its associated tools.
For each tool, the interface can display:
Tool name
Tool identifier
Description
Recent activity
Associated MCP server
The available actions include Graph and Trace.
MCP Servers
Selecting Servers opens the MCP Servers view.
The MCP Servers view lists the MCP servers discovered in the environment.
The view provides information such as:
Server identifier
Server name
Server type
Associated host
Entity identifier
Discovery method
Last-seen information
Creation time
Current status
Depending on the server, associated tools and actions such as Graph and Trace are displayed.
Policy Definitions
Selecting Policy Definitions opens the Policy Definitions view.
The page displays the policy definitions available in the environment.
Each policy definition can display:
Policy identifier
Policy name
Revision information
Status
Last updated time
Selecting a policy displays its details in the right-hand panel.
The policy details can include:
Source
Updated time
Policy source format
Policy schema
Policy settings grouped by sensor or component
The interface can display policy states such as:
Draft
In review
Approved
Review History
The policy details include a Review History section that records policy lifecycle changes, such as transitions between draft, review, and approved states.
Events
Selecting Events opens the Event Log.
The Event Log allows you to load and analyze events from the monitored environment.
Load Events
Use the Load section to configure the events to display.
Available controls include:
Hosts
Range
Select time range
Count
Hide categories
Load / Refresh
Available predefined ranges include:
1h
6h
24h
3d
7d
Analyze Events
Use the Analyse section to filter and review loaded events.
Available filters include:
Type
Severity
Remediation
Search events
Entities
Quick filters include:
All Remediated
New Servers
New Clients
Tool Call Failures
The event list displays individual events with their event type, severity, associated entities, and timestamp.
Reviewed / Dismissed Alerts
Selecting Reviewed/Dismissed Alerts opens the page for alerts that have been acknowledged or dismissed.
The page provides two tabs:
Acknowledged
Dismissed
The corresponding count is displayed with each tab.
When no alerts are available in a category, the page displays a corresponding empty-state message.
Alerts
Selecting Alerts opens the Alerts view.
The Alerts view lists alerts detected in the environment and provides filtering, review, and investigation actions.
Filter Alerts
Use the available controls to narrow the alert list.
Severity: Filter alerts by severity.
Alert type: Filter by a specific alert type.
Search alerts: Search for alerts using available alert information.
Newest first: Sort alerts with the newest alerts first.
Select All: Select multiple alerts when required.
Alert Details
Selecting an alert displays additional information, including:
Alert type
Alert ID
Associated host
Timestamp
Event or context information
The alert details can include the event attributes associated with the alert.
Investigate an Alert
Use the alert actions to move from an alert to its related events or trace information.
Open Alerts.
Use the available filters or search to locate the alert.
Select the alert to review its details.
Select View Events to review events associated with the alert.
Select View Trace to inspect the associated trace.
Select Analyze when further investigation is required.
Reports
Graph Explorer also provides a Report view.
Select Report to access available reports and summary information.
The Report view provides two tabs:
Canned Reports
Executive Summary
Canned Reports
The Canned Reports tab lists predefined reports available in BlueRock.
The report list includes:
Report ID
Report Name
Category
Description
Actions
Use Search reports to find a report by name or other available information.
Use All Categories to filter reports by category.
Select View to open a report.
Executive Summary
The Executive Summary tab provides a high-level summary of system activity.
The summary includes key metrics such as:
Total Agents
Total Servers
Total Tools
Active Alerts
The page also provides Key Highlights, which summarize selected activity and status information.
Recent Alerts
The Executive Summary includes a Recent Alerts section that provides a list of recent alerts.
The report can be used to quickly review the current state of agents, servers, tools, and alerts before investigating individual events or entities.
Last updated