Reading HackGraph

A visual notebook for learning how security concepts connect.

Explore at reading scale

Open a card to read its notes. Use the plus button to reveal connected topics. Large branches offer a list so you can choose the next topic without shrinking the text. Overview shows the arrangement; Return to reading restores readable detail.

Tab to the graph, use Right to expand and visit a child, Left for a parent, and Up or Down for nearby topics in the same column. Space expands or collapses a branch; Enter opens its notes. Escape closes details. Search also matches alternate names and your locally saved notes.

Connections and browsing history

The trail records the topics you visited. It is navigation history, not evidence that those topics form a feasible sequence. Categories organize subjects; start and goal cards provide context. A repeated card is another visual instance of the same underlying topic, used to keep loops readable. Open “About this connection” in a topic's connected-topics list to read the authored relationship.

HackGraph's connections are authored study relationships. They are not imported ATT&CK relationships. MITRE distinguishes associations such as technique hierarchy, observed use, mitigation, and detection in its relationship model. A classification link on a card does not establish the meaning of an arrow connected to it.

The shared relationship definitions in the graph panels explain recurring labels. They appear separately from each connection's explanation and evidence. 3 definitions have AI source comparisons; 1 is a project-defined convention. These records cover the vocabulary, and do not count as reviews of the connections using it.

What the source labels mean

Primary sources are original specifications, vendor documentation, or original project documentation. Research and community sources provide their own analysis. Taxonomy references identify a classification. Database references are curated records that may combine information from several contributors. Unclassified sources have not yet been assigned a source type. These labels describe source provenance, not a guarantee of correctness.

Source types come from an explicit citation label or a recorded classification for that exact publication URL. New URLs remain unclassified until a classification is recorded. Classifying a publication does not review the claims that cite it.

A citation-destination notice means the inspected URL opened a different page or a relocation notice. It can appear alongside a known source type and a successful HTTP response. Check the named publication before relying on that citation.

“Review not recorded” means there is no documented claim-level editorial review. “Selected claims source-reviewed” records who compared particular claims with named source sections, and when. “Historical context” identifies explicitly scoped historical material. A build date describes the site artifact, not when its knowledge was verified.

Authored applicability notes are preserved. Missing applicability is unknown. Version filters reflect existing tags; an undimmed topic does not confirm compatibility. Windows 11 25H2 and 26H1 appear in the catalog with coverage unknown.

Current coverage

The latest recorded HTTP audit checked 874 URLs on 2026-09-07. 869 responded; 5 have automated access exceptions. Of those, 5 publications were located separately through the web reader. The reader may use indexed content. A response or a located publication does not verify a claim. Affected entries explain the recorded observations.

This inventory is generated from the same data as the graph. It counts each entry's explicitly listed reading sources, including taxonomy citations in that list. Automatically displayed mapping links and tool homepages are excluded. Counts describe coverage, not accuracy.

The glossary has 91 definitions: 91 have a recorded AI source comparison, 0 have a recorded human comparison, and 0 need comparison. These counts are separate from the graph entries above. Each comparison covers the displayed definition and its aliases; it does not establish the accuracy of surrounding notes or connections. Editing a definition, alias or source makes its old comparison stale.

ATT&CK identifier status was checked on 2026-09-07 against MITRE's published data (Enterprise ATT&CK 19.2). 117 identifiers were checked; 0 are missing, deprecated, or revoked. This includes mapped IDs and technique/tactic citations in topics, connections, glossary entries, and shared definitions. Identifier checks and HTTP link checks do not verify the associated content.

Report a correction with the topic, a precise claim, a supporting source section, and the context in which it applies.