Which Falcon feature creates a graphical view of users, endpoints, and the connections between them...

The Remote access graph is a powerful visualization tool within the Search and Investigation Tools suite, designed specifically to map the movement and authentication patterns of users across the enterprise. Unlike a flat list of logon events, the graph provides a nodes-and-edges visualization that displays the relationships between specific Users and the Endpoints they have accessed.

A key feature of the Remote access graph is its ability to filter these connections by Logon Type (e.g., Interactive, Network, or Remote Interactive/RDP). For a hunter, this visualization is indispensable for identifying Lateral Movement (T1021). By viewing the graph, an analyst can quickly spot anomalous patterns, such as a single user account logging into an unusually high number of distinct servers via RDP in a short period. It helps in identifying "Hub-and-Spoke" patterns where a compromised administrative workstation is being used as a staging point to touch multiple high-value targets. While the "Geo location activity" focuses on geographic origins and the "Host Timeline" provides a chronological list of events on a single machine, the Remote access graph provides the broad architectural view necessary to understand how an adversary is traversing the network. This capability allows hunters to "follow the trail" of compromised credentials and determine the full extent of an attacker's reach during a multi-stage breach.