Overview
Graph is Persona’s link analysis tool for fraud investigation. It surfaces connections between Accounts based on shared properties. These connections help you identify fraud rings and coordinated attacks that would be invisible when looking at accounts in isolation.
Effective fraud investigation with Graph requires understanding both the underlying concepts of link analysis and the specific terminology used within the product. This glossary covers both, starting with industry-wide concepts and building toward Graph-specific terms.
Industry terms
- Link analysis: A data analysis technique used to identify and evaluate relationships between entities in a dataset, primarily through visualizations.
- Signal: An observation about an object at a point in time that describes relevant risk and trust information.
- Identity mule: A form of fraud where a bad actor pays unsuspecting or willing accomplices to create an account, complete identity verification, and hand over the credentials to the fraudster.
Graph product
- Query: A search request that defines which Accounts you want to surface in Graph. In a Query, you specify at least one property (like email address), and the value of that property. The Query result includes all Accounts with a matching value for that property.
- Graph Explorer: The visual interface in Persona where you can make a Query and explore results.
- Query Template: A saved Query that can be reused in Graph Explorer or run automatically via a Workflow.
- Edge: Synonymous with “link.” “Link” is the user-facing product term; “edge” is the engineering term.
- Sync Graph: A Workflow action step that syncs an Account’s current data into Graph before a query runs. Sync Graph should always precede a Run Graph Query step to ensure results reflect the Account’s most current information.
- Snapshot: A saved record of Graph query results at a specific point in time. Can be generated via the Run Graph Query Workflow step or in Graph Explorer, and surfaced within a Case for review.
- Importer: A no-code connection between an external data source and Persona that imports records as custom Account data for Graph to analyze. Supported sources include CSV, Google Sheets, MySQL, Amazon S3, Google Cloud Storage, Snowflake, Redshift, and SFTP. See Importers Overview to learn how to use importers.
- Indexed account: An Account that has been added to Graph and is available for querying. Accounts are indexed when they complete a Persona Inquiry, are added via the Graph API, or are imported via an Importer.
- Graph module: An embedded Graph view that can be added to a Case template or Account Type layout. It displays connections directly related to the account being reviewed. Unlike Graph Explorer, the Graph module shows direct connections only, not full multi-hop results.
Graph Explorer
- Canvas: The main area of Graph Explorer where Query results appear.
- Node: An item that appears on the Graph Explorer Canvas as a result of a Query. Each node represents either an Account in Persona, or a property of that Account.
- Account node: A node that represents an Account.
- Property node: A node that represents a property of an Account.
- Account property (or, Property): A characteristic of an Account, such as email address or phone number. For a full list of Account properties available in Graph, see Graph Query reference.
- Datum type: The category a property belongs to in Graph. Categories include user-provided information, device and network metadata, first-party data, and third-party data.
- Link: A connection between two nodes. An Account node can be linked to a property node (the Account has that property), or two Account nodes can be linked to a property (both Accounts share that property). Also referred to as an edge in technical contexts.
- Cluster: A group of Account nodes that are all linked to the same property node.
- Cluster size: The number of nodes in a cluster.
- Starting nodes: The initial set of Accounts of interest to you, in a Query. (In Graph theory terms, this is the seed set.)
- Connected nodes: The set of Accounts linked to the starting nodes by shared Account properties.
- Hops: The degrees of separation between a connected node and a starting node. A direct connection (2 hops) means two Accounts share a property directly. An indirect connection (4 or more hops) means Accounts are connected through intermediaries. For example, Account A shares a device with Account B, and Account B shares an email with Account C, making A and C connected by 4 hops.
- Node limit: A setting in the Query editor that controls the maximum number of nodes returned in a query result. A lower limit returns results faster; a higher limit gives a more complete picture at the cost of longer load times. The default is 100.
- Node hover card: The information panel that appears when hovering over a node on the Canvas. For an Account node, it shows the Account’s details; for a property node, it shows the shared value; for an image similarity node, it shows the two images side by side. It also provides quick action options.
This glossary defines the terms. For the values behind them, the Graph Query reference lists every Account property you can query and the format each one matches on, and Graph Explorer interface shows where each term appears on screen.