Quick reference for keyboard shortcuts, mouse controls, node types, and toolbar actions.
| Shortcut | Action |
|---|
Ctrl / Cmd + Z | Undo |
Ctrl / Cmd + Shift + Z | Redo |
Ctrl / Cmd + S | Save graph |
Ctrl / Cmd + A | Select all visible nodes |
Delete / Backspace | Remove selected nodes (and their subtrees) |
Escape | Clear selection / close context menu |
F | Fit view (zoom to show all nodes) |
| Action | Result |
|---|
| Click on a node | Select it, open detail panel |
| Click on empty canvas | Deselect all |
| Click + drag on empty canvas | Pan |
| Scroll wheel | Zoom in / out |
| Pinch (trackpad) | Zoom in / out |
| Double-click a node | Expand connections |
| Shift + click a node | Add to / remove from selection |
| Click + drag on canvas | Box-select nodes within rectangle |
| Right-click a node | Open node context menu |
| Right-click on canvas | Open canvas context menu |
| Type | Category | Represents |
|---|
| Server | Infrastructure | A Tor hidden service (.onion address) |
| Label | Classification | ML-assigned risk category and intent label |
| Port | Infrastructure | Open port and service detected on a server |
| SSH | Infrastructure | SSH host key fingerprint (co-hosting indicator) |
| SHV | Infrastructure | Script Hash Value — identical JavaScript across sites |
| JavaScript | Content | A JavaScript file extracted from a server |
| Image | Content | An image file extracted from a server |
| Bitcoin | Cryptocurrency | Bitcoin (BTC) wallet address |
| Ethereum | Cryptocurrency | Ethereum (ETH) wallet address |
| Monero | Cryptocurrency | Monero (XMR) wallet address |
| Litecoin | Cryptocurrency | Litecoin (LTC) wallet address |
| Dogecoin | Cryptocurrency | Dogecoin (DOGE) wallet address |
| Email | Communication | Email address |
| PGP | Communication | PGP public key fingerprint |
| Telegram | Communication | Telegram username or channel |
| Discord | Communication | Discord server or user reference |
Undo and redo track graph mutations — changes to what is on the canvas. The following actions are tracked:
- Adding a node from search
- Expanding a node (and the nodes that appear)
- Revealing a hidden node type
- Collapsing or expanding a subtree
- Removing a node or selection of nodes
- Clearing the canvas
The following are not tracked (cannot be undone):
- Node selection changes
- Dragging nodes to reposition them
- Node type filter toggles
- Saving or loading a graph
History is capped at 50 steps and resets when a graph is loaded or a new graph is started.
| Option | Action |
|---|
| Expand | Fetch and add connections from the database |
| Collapse | Hide this node’s subtree |
| Uncollapse | Restore a previously collapsed subtree |
| Select Neighbors | Select all nodes directly connected to this one |
| Copy Label | Copy the node’s label text to the clipboard |
| Remove | Remove this node and all its descendants |
| Option | Action |
|---|
| Select All | Select all currently visible nodes |
| Fit View | Zoom and pan to show all nodes |
| Clear Canvas | Remove all nodes and start fresh |
| Button | Action |
|---|
| Graph name | Click to rename the current investigation |
| Undo | Revert last graph mutation |
| Redo | Re-apply reverted mutation |
| Save | Manually save the graph to your account |
| Load | Open the saved graphs list |
| New | Clear the canvas and start a new investigation |
| Export | Download the canvas as PNG or PDF |
| Logout | End your session |
| Behaviour | Detail |
|---|
| Auto-save interval | Every 30 seconds when unsaved changes exist |
| Auto-save condition | Only runs when at least one node is on the canvas |
| What is saved | All nodes, edges, collapsed state, graph name |
| What is not saved | Node type filter state, selection state |
| Storage | MongoDB, tied to your user account |
| Access | Graphs are private — only visible to the account that created them |
| Format | Notes |
|---|
| PNG | Full canvas snapshot at screen resolution. Suitable for embedding in reports. |
| PDF | Canvas exported as a PDF document. Suitable for printing or formal reporting. |
The export captures the entire canvas, not just the visible viewport. Fit the view before exporting (F) to ensure the layout is clean.