Morpheus AI Graph

Last updated: October 19, 2026

Overview

The Morpheus AI Graph is the Incident Workspace card that draws what Morpheus AI found while investigating an incident. Each entity Morpheus recorded—an email, a user, a host, a process, a file, a domain, an IP address—is a node, and each link it traced between two entities is an arrow. You get the attack as one picture, from where it started to where it went, and every node that matches an artifact opens that artifact's full record.

The graph shows only what Morpheus recorded, and it explains its gaps where it can. A node with no artifact record says why in its tooltip, and a node with no connection to the rest of the attack says why when Morpheus recorded a reason, so a gap reads as a finding rather than as a fault.

In short

Opening the Full Graph

Expanding the card gives the graph the whole page, which is the easiest way to read an investigation with more than a handful of entities.

1. On the Incidents page, select the incident's number. The incident's Incident Workspace opens in a new browser tab, with the Morpheus AI Graph card among its cards.

2. Select the expand control at the top right of the card.

3. Select Zoom to Fit in the toolbar at the bottom of the graph. Expanding keeps the graph at the size it had in the card, so this is the step that brings the whole graph into view.

The toolbar has four controls, each named when you hover over it: Zoom In, Zoom Out, Zoom to Fit, and the Show Reviewed switch, which is covered in Marking Nodes as Reviewed.

Reading the Graph

The graph is a map of the attack. Each chain of connections reads from left to right, following each link Morpheus traced from one entity to the next. Each node shows an icon for its type and the entity's name. Long names are shortened on the graph; hover over the name to see it in full.

Hover over a node's icon to see what Morpheus recorded about it. From top to bottom, the tooltip shows:

• the entity's type, with the security tool that reported it on the right—for example, Email reported by Email gateway

• Morpheus's description of the entity, with names such as files and processes highlighted

• REVIEWED BY, with a name and a time, when someone has marked the node as reviewed

• the artifact line—Artifact linked when the node matches an artifact record

• the reason the node stands apart from the rest of the graph, when Morpheus recorded one

Hover over an arrow to read the connection in Morpheus's own words.

Opening an Artifact's Details

Clicking a node opens the artifact record behind it without leaving the incident, so you can check an entity's reputation, its other events and incidents, and its notes straight from the picture.

1. Click a node whose tooltip shows Artifact linked.

Clicking a node with no artifact record does nothing—hover over its icon instead to see why. A reviewed node shown faded with Show Reviewed still opens its record.

Merged Nodes

A merged node is one artifact that Morpheus mentioned more than once, drawn a single time so that each artifact appears on the graph once. It happens when two mentions match the same artifact record—for example, a process that Morpheus describes once when it starts and again when it runs a script later in the attack.

The merged node keeps the name of the first mention. Its tooltip lists the description of every mention, separated by a dot (·), and its arrows carry the connections of every mention, so nothing Morpheus recorded about the artifact is lost.

Marking a merged node as reviewed marks every mention at once, and unmarking it clears them all.

Nodes Without an Artifact Record

A node without an artifact record is an entity Morpheus recorded that does not match an artifact record. It stays on the graph, drawn faded, because it is still part of what Morpheus found. Reviewed nodes shown with Show Reviewed are faded too, so the tooltip line starting No artifact record is what marks a node without a record, and it says why—so you can tell an entity D3 does not track from one whose value looks wrong.

Nodes That Stand Alone

A node that stands alone is an entity Morpheus found during the investigation but could not tie to the attack path—for example, a connection from the same host in the same hour that no process on the path explains. It has no arrows and sits in the column at the right edge of the graph. When Morpheus recorded why, the reason is the last line of the node's tooltip, so you can decide whether it deserves a closer look.

If Morpheus recorded entities but no connections at all, every node stands alone, and a note across the top of the graph reads Morpheus did not record connections between these artifacts. When at least one node carries a reason, the note adds Hover a node for why it stands alone. This tells you the investigation found the entities but not how they relate, which is different from an empty or broken graph.

Marking Nodes as Reviewed

Marking a node as reviewed takes it off the graph once you have checked it, so what remains is what still needs attention. The mark is saved with the incident and records who made it and when, so the rest of your team can see what has already been looked at.

1. Right-click the node.

2. Select Mark as reviewed.

If the reviewed node was at the start or end of a path, no dotted arrow replaces it, so its neighbor can be left with no arrows in the right-hand column; turn on Show Reviewed to see the connection again.

Showing Reviewed Nodes

The Show Reviewed switch, at the right end of the graph toolbar, brings reviewed nodes back so you can see what was checked and by whom. Reviewed nodes return faded, and hovering over one shows REVIEWED BY with the reviewer's name and the date and time in UTC. Clicking a reviewed node still opens its Artifact Detail panel.

To undo a mark:

1. Turn on Show Reviewed.

2. Right-click the reviewed node, and select Unmark reviewed.

Empty and Loading States

The card always says why it has nothing to draw, so an empty card is never mistaken for a broken one.

Availability

The Morpheus AI Graph is one of the cards an administrator can place in an incident workspace, where it is listed as Morpheus AI Graph. Two things your administrator controls decide whether you see it: Morpheus AI incident widgets must be enabled on your D3 instance for the card to be added, and the card must be part of the workspace your incident uses.

Each incident type has its own workspaces. In the classic view, an administrator goes to Configuration > Incident Type Manager > incident type > Incident Workspace. The tab lists the type's workspaces, such as System Default, and New Workspace adds one. As the tab puts it, workspaces can be assigned "to specific groups, roles, or users."

Turning Morpheus AI incident widgets off removes Morpheus AI Graph from the Widgets list in the workspace designer, so the card can no longer be added to a workspace. It does not take the card out of a workspace that already has it: incidents that use that workspace keep showing the card. To stop showing it, your administrator removes the card from the workspace.