Skip to main content
Groups your hosts by how they behave and shows how those groups shift over time. Hosts with similar activity form clusters (behavior groups); as behavior changes between periodic refits, hosts move between clusters. This page visualizes both the current grouping and the movement. On cold load, the page auto-selects the most significant movement flow.
  • Header: title, the subtitle “How hosts group and shift over time”, and a {N} clusters · {M} hosts summary.
  • Insight strip: a card summarizing the most notable change (e.g. “3 hosts moved into Network-heavy”), with a top driver metric and an Investigate Event button when relevant.
  • Canvas (left): the fleet visualization, with a refit timeline beneath it.
  • Evidence rail (right): context panel that changes with your selection.

Fleet canvas

The canvas plots the current snapshot:
  • Cluster bubbles: one per behavior group, sized by host count and colored per cluster, with the label and host count shown. Large bubbles may include a short narrative. Ghost clusters (clusters emptied when all hosts moved away) appear as dimmed bubbles and are excluded from the header cluster count.
  • Idle and Returned pools: special groupings (bottom corners) for hosts with insufficient telemetry and hosts that have reappeared.
  • Movement arrows: curved flows between clusters, with width scaled to the number of hosts and labeled {N} hosts.
  • Host dots: individual hosts inside their bubble (when the Hosts layer is on).

Layers

A small toolbar (top-left of the canvas) toggles overlays. Clusters are always shown; you can turn Movements and Hosts on or off. Movements are unavailable on the very first refit (there’s no previous snapshot to compare). On very large fleets, enabling Hosts focuses you into a cluster (host dots are only drawn within a selected cluster).
  • Scroll to zoom and drag to pan; a Reset view control re-centers.
  • Click a cluster bubble to open its detail (click again to deselect).
  • Click a movement arrow to inspect that flow.
  • Click a host dot to open that host’s trajectory.
  • Click the Idle or Returned pool for its detail panel.
  • Click the background to clear selections.

Refit timeline

Beneath the canvas (when there’s more than one refit), a Timeline control scrubs through snapshots over time. Drag or click the track to jump to a refit, or use Play to replay the snapshots in sequence. Changing the refit clears the current selection. A refit is a periodic re-clustering of the fleet: each point on the timeline is one snapshot of how hosts were grouped at that time. (This control moves through time; it does not change clustering parameters.)

Evidence rail

The right rail shows different content depending on what’s selected.

Activity summary (default)

With nothing selected, the rail shows Activity summary: the recent shifts (up to three flows, e.g. ” hosts → ” with a driver) and the main behavior groups with their host counts. If nothing moved since the previous refit, it says so.

Cluster detail

Selecting a cluster shows its label and host count, an Investigate Event button, an optional narrative, a Cluster Profile (metric bars grouped into Network, Process, and File), and the member Hosts list. The host list can be filtered to Moved hosts (which carry a from badge) and paginates after the first 10.

Movement detail

Selecting a flow shows hosts moved, the from → to clusters, the refit time range, and a confidence level (high/medium/low). Behavior Shifts summarizes the typical change across the moved hosts with signed percentage bars, and an expandable Hosts list breaks down each host’s deltas.

Host trajectory

Selecting a host (or arriving with a host deep-link) shows its current cluster, an optional narrative, its recent trajectory across the last few refits as a color strip, and its most recent move with the top metric deltas that drove it.

Pool detail

Selecting the Idle or Returned pool explains what the pool means and lists its hosts (returned hosts show the cluster they rejoined).
Last modified on October 8, 2026