# Tier0 Analysis

Accessing the Tier0 Analysis Module

* Navigate to the Visualize section in the application menu.
* Select the Tier0 Analysis option.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2FTfoBmAABbaztz7am5u74%2Fimage.png?alt=media&#x26;token=24ac44b0-16d3-4ee8-87d5-df94e919eed8" alt=""><figcaption><p>Tier0 Analysis Module - Tier0 Node</p></figcaption></figure>

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2FcxU9fiMgc12SNZgbAP6I%2Fimage.png?alt=media&#x26;token=ee08a67b-b47e-4893-9026-81fa6a659b1f" alt=""><figcaption><p>Tier0 Analysis Module - Group1 Node</p></figcaption></figure>

### Graph View

* The central area displays an interactive graph where nodes represent object groupss, and edges represent relationships.
* Different colors indicate sum members count in nodes.
* Hovering over a node provides additional details about the object.
* The graph visualizes relationships between Tier0 (red node) and Tier2 (other nodes) objects.
* Edges represent different types of relationships (e.g., IN\_GROUP, GenericAll).

**Tier2 to Tier0 Relationships**

* Direct or indirect relationships between Tier2 and Tier0 objects can indicate potential privilege escalation vectors.

**Tier2 to Tier2 Relationships**

* Analyze relationships among Tier2 objects to identify lateral movement paths. For example, a user in one group may have access to another group due to nested memberships.

### **Info Panel**

On the right side, the Info panel shows detailed information about the selected node, including:

* **FSName:** Fully Qualified Name of the object.
* **Type:** Object type (e.g., Tier, User, Group, Computer).
* **Guid:** Globally Unique Identifier.
* **Id:** Object ID.
* **Member Count:** Number of direct members.
* **Sum Member Count:** Total number of members, including nested members.
* **Outgoing Relation:** Name of relationship originating from that group.

### **Members Table**

* Below the Info panel, the Members table lists all members of the selected group, along with their types, incoming and outgoing relation counts to parent group's members.

<figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2FmuSRGyjgu5QqktsByQx7%2Foutgoing-relation.png?alt=media&#x26;token=6276ff7f-2542-4966-acce-712fa06b164b" alt=""><figcaption><p>Node focus and Outgoing Relation</p></figcaption></figure>

#### **Color-Coded Risk Levels**

The system utilizes a standardized color scheme to represent the **risk level** or **sensitivity** of objects within the Active Directory environment. This visual indicator helps users quickly identify high-risk components such as **Tier0** and **Tier2** objects, as well as neutral or informational entities like standard users or computers.

The algorithm calculates the **risk score** for each group by analyzing its **sum member count** , which includes both direct and indirect members (e.g., nested group memberships). Based on this score, the group is assigned a **color-coded risk level** that reflects its potential impact on security.

Each object is assigned a **numerical score between 0 and 100** , which corresponds to one of four **color-coded risk levels** :

| Score Range |                                                                                                                                               Colour                                                                                                                                               |          Node          |
| :---------: | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------: | :--------------------: |
|   **100**   |     <div><figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2F68U3r9YhPQ1V4pl9Cekq%2Ftier0.png?alt=media&#x26;token=dd342db5-e6b2-45ed-9a4a-40115d22015c" alt=""><figcaption></figcaption></figure></div>     |    Tier0 (High Risk)   |
|  **75–99**  |   <div><figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2FaqdNyONL6SW9qmOsgMq2%2Ftier2-high.png?alt=media&#x26;token=ba9101d7-c842-4216-83a2-4f030c40d876" alt=""><figcaption></figcaption></figure></div>  |  Tier2 (Moderate Risk) |
|  **50–74**  | <div><figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2FTeyavNFvFMnpvprG9XjH%2Ftier2-warning.png?alt=media&#x26;token=6aad3a61-b565-4c5a-9b28-b0c498fda2cb" alt=""><figcaption></figcaption></figure></div> | Tier2 (Potential Risk) |
|   **0–49**  |   <div><figure><img src="https://3408039743-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FObpV44hoVkNmo5bFuVVL%2Fuploads%2FoVWi2OVhASKLdml7yOdb%2Ftier2-info.png?alt=media&#x26;token=c8e73312-a8c2-4711-8e6f-0d6a4ba54ab8" alt=""><figcaption></figcaption></figure></div>  |    Tier2 (Info Risk)   |
