[Contextual Security] add relationship node type for entity graph by alexreal1314 · Pull Request #249479 · elastic/kibana

alexreal1314 · 2026-01-18T08:25:34Z

Summary

Introduces a new "relationship" node type to the entity graph visualization, enabling the display of relationships between entities (e.g., "Owns", "Has Access") alongside event-based connections.

Key changes

Area	Changes
New Component	`RelationshipNode` with distinct dark styling to differentiate from event labels
Graph Layout	Updated layout and edge handling to properly position relationship nodes
Utilities	Added `isConnectorNode` for shared label/relationship node logic
Storybook	New `EventsAndEntityRelationships` story demonstrating a realistic AWS scenario

How to test

Deploy a local env using the following command:
node scripts/es snapshot --license trial -E path.data=../default -E reindex.remote.whitelist=kfir-graph-viz-wip-ba715e.es.eu-west-1.aws.qa.elastic.cloud:443 -E xpack.security.authc.api_key.enabled=true
run yarn storybook cloud_security_posture_grap and check the following stories:
a. Go to Graph Components -> Graph Layout -> Events and Entity Relationships.
b. Go to Graph Components -> Relationships Node.

Checklist

Check the PR satisfies following conditions.

Reviewers should verify this PR satisfies this list as well.

Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
If a plugin configuration key changed, check if it needs to be allowlisted in the cloud and added to the docker list
This was checked for breaking HTTP API changes, and any breaking changes have been approved by the breaking-change committee. The release_note:breaking label should be applied in these situations.
Flaky Test Runner was used on any tests changed
The PR description includes the appropriate Release Notes section, and the correct release_note:* label is applied per the guidelines
Review the backport guidelines and apply applicable backport:* labels.

Screenshots

add RelationshipNode component with dedicated styling add EventsAndEntityRelationships story demonstrating events and entity relationships update related schemas and add unit tests for RelationshipNode component update graph popover story with entity relationship options

elasticmachine · 2026-01-18T13:03:14Z

Pinging @elastic/contextual-security-apps (Team:Cloud Security)

kfirpeled

Some misalignments from the design

We should not show the arrow marker when the edge comes to the relationship
The edge should stretch to the node - see gaps of few pixels
The edge color of relationships has a different color in the design

While the width of the relationships is aligned with the width of events/alerts nodes, the edge curve of relationships is not aligned with the curve of events/alerts.

kfirpeled · 2026-01-18T17:30:21Z

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

  schema.literal('diamond'),
  schema.literal('label'),
  schema.literal('group'),
+  schema.literal('relationship'),


Just a side note, the naming convention here is not aligned with the current design. However, I'm thinking to propose a new change to the existing node's names.

Instead of shape, we will have element type: relationship/entity/event/stack.

So I'm ok with keeping it now as it is.

"relationship" sounds very business-domain specific to me, though I don't have a better suggestion.

On the other hand, I like the idea of future renaming label nodes to event, since we also have labels in each node

I agree with both comments - right now we are coupling shape with node type. As I see it we should have the following:

node.type = element type - as mentioned @kfirpeled relationship/entity/event/stack.

one of the node params should be the shape. so we could reuse the component to display similar types - although need to check if its possible without major changes.

this would also require us to return additional property for each node - type.
For now i would leave current behavior and do it in a separate task.

kfirpeled · 2026-01-18T17:31:19Z

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

+  schema.object({
+    shape: schema.literal('relationship'),
+    color: nodeColorSchema,
+    parentId: schema.maybe(schema.string()),


I'm not sure we would like to stack relationships - worth to double check with design

left a question.

decided to support stacked nodes for relationships as well.

depending on the proposed design - we could add more fields such as count and documentsData as a placeholder to store entities data if we decide to add some popover menu actions later.

@kfirpeled as discussed in the sync - we are going to show relationship nodes in stacked groupes as well.

Since then I think we reverted that decision not to stack.. anyway. Lets leave it here for now

yes, I would leave it for now to see if all cases are covered - if not ill remove it.

...d-security-posture/graph/src/components/node/relationship_node/relationship_node.stories.tsx

kfirpeled · 2026-01-18T17:39:09Z

...d-security-posture/graph/src/components/node/relationship_node/relationship_node.stories.tsx

+    label: {
+      control: { type: 'text' },
+    },
+    interactive: {


When interactive is false - the element is still clickable and have an effect.
While It shouldn't be interactive to mouse clicks

we have the same effect today for every node, its not movable but there is a click effect.

Screen.Recording.2026-01-18.at.22.16.41.mov

Yep, that's a bug.. shouldn't happen

fixed for all node types.

alexreal1314 · 2026-01-18T20:09:49Z

Some misalignments from the design
1. We should not show the arrow marker when the edge comes to the relationship 2. The edge should stretch to the node - see gaps of few pixels 3. The edge color of relationships has a different color in the design While the width of the relationships is aligned with the width of events/alerts nodes, the edge curve of relationships is not aligned with the curve of events/alerts.

fixed, there is still slight misalignment which happen in a specific case - in the middle child which is an existing issue.

ill try to investigate it a bit, but probably will create a separate ticket for that.

albertoblaz · 2026-01-19T15:13:20Z

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

  schema.literal('diamond'),
  schema.literal('label'),
  schema.literal('group'),
+  schema.literal('relationship'),


"relationship" sounds very business-domain specific to me, though I don't have a better suggestion.

On the other hand, I like the idea of future renaming label nodes to event, since we also have labels in each node

.../solutions/security/packages/kbn-cloud-security-posture/graph/src/components/graph/graph.tsx

albertoblaz · 2026-01-19T15:25:42Z

...kbn-cloud-security-posture/graph/src/components/node/relationship_node/relationship_node.tsx

+export const TEST_SUBJ_HANDLE = 'relationship-node-handle';
+export const TEST_SUBJ_HOVER_OUTLINE = 'relationship-node-hover-outline';
+export const TEST_SUBJ_TOOLTIP = 'relationship-node-tooltip';
+export const TEST_SUBJ_LABEL_TEXT = 'relationship-node-text';


nit: Move this to the test_ids.ts file? I think we keep these test ids locally for <Ips> and <CountryFlags> but they were the only exceptions and we're doing the same here (very minor comment)

x-pack/solutions/security/packages/kbn-cloud-security-posture/graph/src/components/utils.ts

...ions/security/packages/kbn-cloud-security-posture/graph/src/components/edge/default_edge.tsx

...ity/packages/kbn-cloud-security-posture/graph/src/components/graph/graph_popover.stories.tsx

albertoblaz

Question: How does relationship nodes work with grouping? What if we have multiple relationships between 2 grouped entity nodes? Asking because it seems there's no counter value rendered by the RelationshipNode component, and you added for now support for stacked relationships but it's still TBC by design.

alexreal1314 · 2026-01-20T10:22:56Z

Question: How does relationship nodes work with grouping? What if we have multiple relationships between 2 grouped entity nodes? Asking because it seems there's no counter value rendered by the RelationshipNode component, and you added for now support for stacked relationships but it's still TBC by design.

We could have such case, I asked here about it.

…d relationships update storybook unit tests

…ests

albertoblaz

LGTM

alexreal1314 · 2026-01-28T07:25:38Z

@kfirpeled As i currently work on the graph api to support relationships fetching and I used this branch as the base branch seems like the fields we defined for the relationship node edge are sufficient. If I encounter anything which is missing i'll add them as part of the subsequent PR.

kfirpeled

Missing minimap support

kfirpeled · 2026-01-29T10:33:09Z

x-pack/solutions/security/packages/kbn-cloud-security-posture/common/schema/graph/v1.ts

+  schema.object({
+    shape: schema.literal('relationship'),
+    color: nodeColorSchema,
+    parentId: schema.maybe(schema.string()),


Since then I think we reverted that decision not to stack.. anyway. Lets leave it here for now

kfirpeled · 2026-01-29T10:34:13Z

...ions/security/packages/kbn-cloud-security-posture/graph/src/components/edge/default_edge.tsx

kfirpeled · 2026-01-29T10:34:19Z

...ck/solutions/security/packages/kbn-cloud-security-posture/graph/src/components/edge/utils.ts

kfirpeled · 2026-01-29T10:34:55Z

...d-security-posture/graph/src/components/node/relationship_node/relationship_node.stories.tsx

+    label: {
+      control: { type: 'text' },
+    },
+    interactive: {


Yep, that's a bug.. shouldn't happen

kfirpeled · 2026-01-29T10:37:11Z

...kbn-cloud-security-posture/graph/src/components/node/relationship_node/relationship_node.tsx

Not sure what can be a better name for LabelShape or LabelNodeContainer

it is being used as the label of the edge..

Connector is one option you already used, which can be a good fit

Yes, this is a good option to call it something like ConnectorNode once we do #249479 (comment) to render different types of connector nodes in a single ConnectorNode.

update minimap story and minimap unit tests

alexreal1314 · 2026-01-31T15:24:36Z

Missing minimap support

added, thanks.

…ctive is false make the graph component refresh when interactive is toggled to reflect the changes

elasticmachine · 2026-01-31T18:13:41Z

💛 Build succeeded, but was flaky

Failed CI Steps

FTR Configs #127

Test Failures

[job] [logs] FTR Configs #127 / "before all" hook in "{root}"

Metrics [docs]

Module Count

Fewer modules leads to a faster build time

id	before	after	diff
`securitySolution`	8699	8700	+1

Public APIs missing comments

Total count of every public API that lacks a comment. Target amount is 0. Run node scripts/build_api_docs --plugin [yourplugin] --stats comments for more detailed information.

id	before	after	diff
`@kbn/cloud-security-posture-graph`	58	59	+1

Async chunks

Total size of all lazy-loaded chunks that will be downloaded as the user navigates the app

id	before	after	diff
`securitySolution`	10.9MB	10.9MB	+2.7KB

Unknown metric groups

API count

id	before	after	diff
`@kbn/cloud-security-posture-graph`	90	91	+1

History

💛 Build #386732 was flaky af5bfdd
💔 Build #384700 failed 5599a55
💚 Build #383850 succeeded 7f9f3e0
💚 Build #382942 succeeded c1e88b7
💔 Build #382912 failed a51ff8e
💚 Build #382887 succeeded dea41f1

cc @alexreal1314

…iew_cps * commit '3cd2ea4a515d8a0aafd32f75dc61f1cff892a4b0': Fix Failing test: APM Service overview - header filters (elastic#250355) [ES|QL] Small improvements on the editor (elastic#251004) [ES|QL] Refactor promql validation (elastic#250996) [ES|QL] Update the readme in esql-utils (elastic#251024) [ES|QL] Grouping functions as arguments to scalar functions (elastic#251015) [ES|QL] focus editor when user uses visor (elastic#251084) [Contextual Security] add relationship node type for entity graph (elastic#249479) [One Workflow] Fix email connector documentation: to field (elastic#251171)

alexreal1314 added 2 commits January 13, 2026 19:57

Merge branch 'main' into 247768-relationship-edge-type

fa5edfa

alexreal1314 changed the title ~~add relationship node type for entity graph~~ [Contextual Security] add relationship node type for entity graph Jan 18, 2026

update relationships node data schema

dea41f1

alexreal1314 requested review from albertoblaz and kfirpeled January 18, 2026 13:01

alexreal1314 marked this pull request as ready for review January 18, 2026 13:01

alexreal1314 requested a review from a team as a code owner January 18, 2026 13:01

alexreal1314 self-assigned this Jan 18, 2026

alexreal1314 added the Team:Cloud Security Cloud Security team related label Jan 18, 2026

alexreal1314 added backport:skip This PR does not require backporting release_note:skip Skip the PR/issue when compiling release notes labels Jan 18, 2026

kfirpeled added the ci:build-storybooks label Jan 18, 2026

kfirpeled requested changes Jan 18, 2026

View reviewed changes

alexreal1314 marked this pull request as draft January 18, 2026 17:40

kfirpeled reviewed Jan 18, 2026

View reviewed changes

fix relationship node alignement

a51ff8e

alexreal1314 marked this pull request as ready for review January 18, 2026 20:12

alexreal1314 requested a review from kfirpeled January 18, 2026 20:17

fix type error in graph api integration test file

c1e88b7

albertoblaz reviewed Jan 19, 2026

View reviewed changes

...ity/packages/kbn-cloud-security-posture/graph/src/components/graph/graph_popover.stories.tsx Outdated Show resolved Hide resolved

albertoblaz reviewed Jan 19, 2026

View reviewed changes

remove duplicate util functions

d316264

alexreal1314 added 3 commits January 20, 2026 17:07

add EventsAndRelationshipsStacked story with stacked event actions an…

31cc552

…d relationships update storybook unit tests

move relationship node test ids to a different file and update unit t…

5f24bcd

…ests

Merge branch 'main' into 247768-relationship-edge-type

7f9f3e0

alexreal1314 requested a review from albertoblaz January 21, 2026 17:22

albertoblaz approved these changes Jan 21, 2026

View reviewed changes

alexreal1314 added 2 commits January 22, 2026 10:13

Merge branch 'main' into 247768-relationship-edge-type

5599a55

Merge branch 'main' into 247768-relationship-edge-type

af5bfdd

kfirpeled reviewed Jan 29, 2026

View reviewed changes

alexreal1314 added 2 commits January 30, 2026 09:58

Merge branch 'main' into 247768-relationship-edge-type

cf99142

add support for relationship nodes in minimap

0538f11

update minimap story and minimap unit tests

fix graph nodes being clickable and have hover effect even when itera…

287e3c4

…ctive is false make the graph component refresh when interactive is toggled to reflect the changes

alexreal1314 requested a review from kfirpeled January 31, 2026 18:34

kfirpeled approved these changes Feb 1, 2026

View reviewed changes

Merge branch 'main' into 247768-relationship-edge-type

dda90fb

alexreal1314 merged commit 5103837 into elastic:main Feb 1, 2026
17 checks passed

kibanamachine added the v9.4.0 label Feb 1, 2026

albertoblaz mentioned this pull request Apr 8, 2026

[Internal]: Graph Visualization in 9.4 — entity relationships, entity flyout integration, license gating elastic/docs-content#5830

Open

Conversation

alexreal1314 commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key changes

How to test

Checklist

Screenshots

Uh oh!

elasticmachine commented Jan 18, 2026

Uh oh!

kfirpeled left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexreal1314 Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

alexreal1314 commented Jan 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

albertoblaz left a comment

Choose a reason for hiding this comment

Uh oh!

alexreal1314 commented Jan 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

albertoblaz left a comment

Choose a reason for hiding this comment

Uh oh!

alexreal1314 commented Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

kfirpeled left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

alexreal1314 commented Jan 18, 2026 •

edited

Loading

alexreal1314 Jan 18, 2026 •

edited

Loading

alexreal1314 commented Jan 18, 2026 •

edited

Loading

alexreal1314 commented Jan 20, 2026 •

edited

Loading

alexreal1314 commented Jan 28, 2026 •

edited

Loading

alexreal1314 Jan 31, 2026 •

edited

Loading