# Knowledge graph and analytics

> How the knowledge graph links hosts, services, vulnerabilities and access, its two backends, and the attack-chain dashboard built from it.

The PostgreSQL record answers *what a command printed*. The [knowledge graph](https://pentagi.com/docs/glossary/#knowledge-graph) answers *how two [findings](https://pentagi.com/docs/glossary/#finding) connect* — which host runs which service, which vulnerability led to which access.

## [Two backends](https://pentagi.com/docs/enterprise/knowledge-graph/#two-backends)

|                                                             | graphstore                     | graphiti                            |
| ----------------------------------------------------------- | ------------------------------ | ----------------------------------- |
| Runs as                                                     | in the backend, graph in Neo4j | separate service on Neo4j           |
| Enabled by                                                  | `GRAPHSTORE_INGEST_ENABLED`    | `GRAPHITI_ENABLED` + `GRAPHITI_URL` |
| [Agent](https://pentagi.com/docs/glossary/#agent) [tool](https://pentagi.com/docs/glossary/#tool) | `graphstore_search`            | `graphiti_search`                   |
| Status                                                      | successor to graphiti          | legacy, kept for comparison         |

Both are scoped to one [flow](https://pentagi.com/docs/glossary/#flow): every read filters by it, so one flow never sees another flow's graph.

Both backends are off by default. With `GRAPHSTORE_INGEST_ENABLED=true`, the graphstore needs `GRAPHSTORE_NEO4J_URI` and `GRAPHSTORE_NEO4J_DATABASE`, and PentAGI does not start without them.

With Graphiti enabled too, the two backends store assets differently, so PentAGI refuses to start when both write a database of the same name on one server, or on any server while Graphiti's `NEO4J_URI` is unset, unless `GRAPHSTORE_ALLOW_SHARED_NEO4J_DATABASE=true`. The bundled Neo4j is Community and serves only the `neo4j` database: with both backends on it, keep `neo4j` and allow sharing, at a cost in graph quality, since ports and services are stored twice and some Graphiti writes can be rejected. To keep the graphs apart, give the graphstore its own Neo4j server, or its own database on Neo4j Enterprise: PentAGI creates that database when missing if the graphstore's Neo4j account may create databases; otherwise create it beforehand.

## [Attack-chain dashboard](https://pentagi.com/docs/enterprise/knowledge-graph/#attack-chain-dashboard)

![Main attack chain: hosts, ports, services, vulnerabilities, confirmed access and accounts](https://pentagi.com/images/product/attack-chain.webp)

With the knowledge graph enabled, the flow's **Dashboard → Analytics** tab renders the graph as it grows:

* **Main Attack Chain** — hosts, ports, services, vulnerabilities, confirmed access and accounts.
* **Action Chain**, **Infrastructure**, **Access Chain** and **Priv Esc Chain** views.
* A timeline scrubber to replay how the picture developed, plus tables of open ports, detected CVEs and credential status.

![Access chain view](https://pentagi.com/images/product/access-chain.webp)

![Attack surface and confirmed access summaries](https://pentagi.com/images/product/analytics-stats.webp)