The product's own user guide. Every screen shows Aldervane Health, a fictional organization. All data is synthetic.
9. Entities and the intelligence wiki
The question it answers
Who and what is in this picture, and how are they connected?
Behind every finding and story are entities: organizations, people, government bodies, technologies and threat groups. Ciphren keeps track of them and of how they're related. For example, Brisemont Imaging supplies Aldervane Health, and Umbral Mantis targets regional hospitals. The connections are what turn separate facts into a picture you can reason about.
The entity browser
Where: navigation ▸ Entities (the page is titled "Entity Browser"). The wiki is under Intelligence Wiki.
Entities lists everyone and everything tracked, with its type, its organization, its MRI score (the exposure score from chapter 2), whether it's in scope, and how well sourced it is.
- ◎ In scope: the entity is connected, directly or through others, to something your setup declares (the page calls these anchors): your organization, a supplier, or another organization Ciphren collects on. All six of Aldervane's suppliers carry it, and so does the regulator investigating one of them. No mark doesn't mean irrelevant, only that no connection has been shown.
- Sourcing: single-source means one source reported it. Corroborated means several did. Filter to Corroborated+ when you need to be sure. Your own organization can read single-source too, because its details come from your setup rather than from several reports. It isn't in doubt.
- Watch: an MRI of 70 or more.
The relationship graph
Graph draws the same entities as a network. Force, Hive, Arc and Constellation are different layouts of the same network. Each type has its own shape as well as its own colour, so the graph reads without colour vision. The legend gives the key. Your organization sits at the centre, with its sites, suppliers and people around it.
Why a graph. Some risks only show up as connections. A supplier that serves several of your departments, or a threat group linked to incidents at two of your suppliers, is a pattern a list won't show you.
An entity's profile
Each entity has a profile. For your own organization it's the most complete single page in Ciphren:
- MRI, and what it's made of: the score (open-ended, see chapter 2), and what it rests on: how much comes from published CVSS scores, how much from vendors' own ratings, how much from general practice, and how much from findings with no severity claimed at all. A score you can't break down is one you shouldn't act on.
- What was observed: findings, domains, hosts, incidents and technologies.
- Patch cadence ("some activity observed"): upgrades seen between collections, and how long critical findings took to close. It's careful about what it can't see. A finding that disappears isn't counted as fixed unless an upgrade was actually observed. And some fixes are invisible from outside: on Red Hat-family servers, in-place patching doesn't change what the server announces, so no events there doesn't mean no patching.
- Collection context: a short brief on the estate as collected, and when the next collection is due.
- Chain of exposure and topology: the relationships that could carry risk to or from this entity.
The intelligence wiki
The wiki presents the same knowledge as an encyclopedia rather than a dashboard: one article per supplier, location, technology, finding type and storyline. It's the place to read about something rather than triage it. Every number in it is the same one the operational pages compute.
Why a wiki. Not everyone who needs the picture works in security. A procurement lead can read a supplier's article, and a site director can read their location's. Neither has to learn the findings list to do it.
What to do with it
- Before a supplier meeting: read its article, then check its connections in the graph.
- When a name you don't recognise appears in a story: open its profile to see how it's connected to you.
- For your own organization: the profile's patch cadence is a fair, outside-in view of how quickly fixes land. It's worth tracking quarter to quarter.