Corsha Connection Canvas
This guide gives an overview of the interactive Corsha Connection Canvas and its many features.
Location
To visit the Connection Canvas page, simply click on the icon in the navigation panel on the left side of the page or set your URL to [Console URL]/connection-canvas directly.
Just look for this icon in the navigation panel: 
Concepts
The purpose of the Connection Canvas is to display connection rules between machine identities within the network and let users interact with them. To accomplish this, we break the data down into a few different categories:
Machine Identities
Each circular node on the screen represents a machine identity: a collection of one or more real-world physical or virtual devices. These can be laptops, printers, routers, or any other device plugged into the network, even including virtual machines.
Connection Rules
Connection rules are secure policies set between different machine identities. In the Canvas, these will show as lines connecting the machine identity nodes. Each one has a direction, shown with an arrow going from source to destination. Labels on each line will show how many connection rules are currently visible. This number will be reduced when using filters, which is explained later on.
Machine Groups
Machine identities can be grouped into collections that we call Machine Groups. In the Connection Canvas, these are illustrated as blue rectangles surrounding several machine identity nodes. For the sake of convenience, users can move entire machine groups around the Canvas by clicking and dragging on them, which will move every grouped machine identity node at the same time.
Gatekeepers
Gatekeepers are optional machine identity nodes that sit at the edge of machine groups and gather all connection data flowing in or out of their machine group. In the Connection Canvas, these are shown as green circles. When isolating nodes that send or receive connections via a Gatekeeper, the gatekeeper node will always remain visible.
In the event that a group does not contain a gatekeeper, a border node will be added to the Machine Group in its place. This works exactly like a gatekeeper, but is only included to add visual clarity.
Features
Want to learn how the Connection Canvas can help you understand activity happening on your network? Take a look through the rich features built into the application and you'll be an expert in no time.
Navigation
Panning
To pan the Canvas, simply click and drag in the empty space between nodes. The Canvas will move as you do this, revealing more nodes from offscreen. If you end up getting lost, take a look at the Minimap section of this guide to help get your bearings.
Zooming
There are multiple ways to zoom in and get a closer look at the data:
- Click on the Zoom In (+) or Zoom Out (-) buttons in the control panel, located in the upper-left corner of the screen
- Scroll your mouse wheel up to zoom in, and down to zoom out
If you are zooming with the mouse's scroll wheel, the Canvas will zoom in or out based on the location of the cursor. So if you want to see a specific area of the Canvas, hover over it with the mouse cursor and scroll the wheel up.
Fit to Screen
If you want to zoom all the way out and see the entire network displayed on the screen at once, click the third button in the control panel, labeled "See whole graph". Clicking this will zoom and reposition the camera so that the entire network fits comfortably within the screen bounds. If you have repositioned machine identity nodes or machine groups, the camera will always zoom out far enough to let you view all of the network data.
When zoomed in, use the minimap in the lower-left corner to help you understand which part of the Canvas you are viewing.
Fullscreen
The Connection Canvas is designed to work in fullscreen as well as in a window. To toggle fullscreen mode, just click the fourth button down in the control panel, labeled Enter Fullscreen. To return, click the same button or press the ESC key on your keyboard.
Counter
In the upper-right corner of the screen is a small amount of text showing the number of machine groups, machine identities, and connection rules in the network data.
When filtering machine identities or connection rules, these numbers will update to reflect the new totals. If the user has selected a machine identity node, the counts will display as fractions, showing the number of isolated machine groups, machine identities, and connection rules out of the filtered totals.
Minimap
In the lower-left corner is a smaller version of the Canvas, called a minimap. This minimap does not zoom or pan, but instead lets you see where the camera view is on the main Canvas.
If you zoom into a small section of the Canvas, you will see the dark rectangle overlaying the minimap move to indicate the position of each corner of your screen. This way you always have a big picture of where you are, no matter which part of the Canvas you're looking at.
The minimap will also update in realtime as you move machine identity nodes and groups around the Canvas.
Interaction
One of the key features of the Connection Canvas is interactivity. As well as panning and zooming around the Canvas, users can also reposition, isolate, and filter machine identities, connection rules and machine groups.
Isolating a Machine Identity
To isolate a machine identity node, simply click on it. This will cause all machine identities and connection rules that do not interact with this machine identity to fade out and the camera to zoom and show the isolated machine identities and connection rules that do.
While a machine identity is isolated, you may notice the number of connection rules to nearby machine identities change in order to only show ones that interact with the isolated machine identity. Also notice that when isolating machine identities, the counter in the upper-right corner updates to show the number of machine groups, machine nodes, and connection rules are associated with your selected machine identity.
To remove the selection, just click the white background
Viewing a Group
Clicking once within the bounds of a machine group will zoom the camera to show the group on screen, allowing you to see every one of the group's machine identities at once.
Filtering Machine Identities and Connection Rules
Above the Canvas itself is a bar with various filter controls. These are used to narrow down the scope of displayed data and filter out potentially irrelevant information. When filtering, the counter in the upper-right corner will update to only show counts of machine groups, machine identities, and connection rules currently allowed by the filter.
Search Text
Adding text to the Search input will remove any machine identities that do not match the search text. The Connection Canvas matches on the machine identity name, IP address, MAC address, machine group name, and vendor. If the search text exists within any of these fields for a given machine identity, that machine identity's node will remain visible in the Canvas. Non-matching nodes will turn gray and fade into the background.
Protocol
The filter controls also allow users to filter by connection rule details. By clicking on the Protocol dropdown, you can filter connection rules by multiple protocols. If a given connection rule uses one of the protocols added to this filter, then the connection rule and both of its connected nodes will display. Otherwise, they will fade into the background.
Connection Status
Aside from filtering by protocol, you can also choose to only show connection rules that have an Allowed or Blocked status, respectively.
Tooltips
By hovering the cursor over a machine identity node, you can display a tooltip, showing relevant information about the node's machine identity. This includes its name, IP address, MAC address, vendor, and machine group.
If a filter is active, any matching fields in the machine identity's data will be highlighted.
Getting More Information
To get detailed information for any machine identity, simply double-click on any machine identity node. This will open a new tab in the browser and direct the user to the Machine Detail page for that machine identity. The same can be done for a machine group or a gatekeeper node. Just note that non-gatekeeper border nodes will not do anything when double-clicked.
Saving and Loading Custom Layouts
After dragging machine identity nodes or machine groups around to reposition them, users can save their custom layout. This way, when reloading or navigating back to the page, the Connection Canvas will restore the previous layout. Keep in mind that the user's custom layout is only saved locally, however, and will not be seen by other users.
To save a custom layout, simply click the Save Custom Layout button in the control panel. To restore the default layout, click the Restore Auto Layout button just below it. If you have a saved custom layout and wish to restore it, simply reload the page.
Physics
In order to display the entire Canvas in a meaningful way, we run a physics simulation on the connected machine identity nodes. The simulation causes nodes to push away from each other and move into a more comfortable position, which helps to separate the data and avoid overlapping. For more complex networks, however, this is sometimes not enough. The last button in the control panel, labeled "Enable Physics", lets users toggle the physics simulation so that the machine identity nodes and groups continue to move away from each other to avoid overlapping.
To activate physics, just click the button, then click again to disable it.
When the simulation is running, users can drag and drop any part of the Canvas. This will temporarily pause the physics calculations until the user releases the held node or group, at which point it will begin running again. Rearranging nodes and then activating the physics simulation can be a helpful way to keep the Canvas clean and readable. Being able to move nodes around and see them in motion can help users get a much better understanding of the network than a static image could.
Conclusion
The Connection Canvas is a powerful tool that enables you to quickly get a detailed view of how machine identities in your network are interacting with each other. We hope that you will find it helpful and intuitive to use, but if you have any feedback, positive or negative, please don't hesitate to let us know.