Explain the internal working of the entity graph/relationship model?

The entity graph represents the users, hosts, IPs, files, and other objects observed across ingested telemetry as nodes, with edges connecting entities that have been observed interacting — a user logging into a host, a host connecting to an IP, a process touching a file — building a navigable relationship structure rather than treating every entity as an isolated, disconnected record.

Because UDM events already carry structured fields like principal (the actor) and target (the object acted upon), the relationships needed to build this graph are largely inferable directly from the normalized event structure itself, without requiring a separate, manually maintained mapping of how entities relate to each other.

During an investigation, this graph is what lets an analyst pivot from one entity to its connections — starting from a single suspicious host and traversing outward to the users who logged into it, the other hosts it communicated with, and the files it touched — surfacing broader context around an incident that wouldn't be visible from looking at any single triggering event in isolation.