The Domain Was Just the Beginning: Building GraphGuard AI with FalkorDB

Sudhir Gunnam — Sun, 18 Oct 2026 04:20:51 +0000

The Domain Was Just the Beginning: Building GraphGuard AI with FalkorDB

One suspicious domain. A web of relationships. A different way to investigate.

By Team SynapGraph | Graph Hacks 2026 | Track 1 — Agents That Act on Connected Data

Every Threat Leaves a Trail. Can You Connect It?

Imagine an analyst investigating a suspicious domain.

At first, there is only a name on a screen.

But that name might point to an IP address. It might be associated with a digital certificate. It might appear in a threat-intelligence report. Each connection offers another clue, and every clue raises a new question.

Is this connection meaningful? Where did the information come from? What should the analyst investigate next?

The challenge is not simply collecting more security data. It is discovering how the pieces connect without confusing a clue with proof.

That question became the starting point for GraphGuard AI.

We are Team SynapGraph, and for Graph Hacks 2026, we set out to explore how graph databases and AI-assisted investigation workflows could make cybersecurity evidence easier to follow, understand, and investigate.

Our chosen track was Track 1: Agents That Act on Connected Data.

Our central idea was simple:

Don't just show the indicator. Show the relationships that give it context.

Meet GraphGuard AI: An Investigation That Follows the Connections

GraphGuard AI is a graph-powered cybersecurity investigation prototype designed to explore relationships between domains, IP addresses, certificates, and reports.

Instead of treating every indicator as an isolated record, the application uses a connected graph to retrieve related information and present it through an investigation workflow.

The technology stack brings together three key components:

FalkorDB — the relationship engine. Stores and queries the connected cybersecurity entities that underpin the investigation.
FastAPI — the investigation interface. Connects the backend workflow to API endpoints.
Streamlit — the analyst's workspace. Provides a dashboard for submitting indicators and reviewing results.

Docker supports the local development and demonstration environment.

Together, these components form a practical experiment in making connected security evidence easier to explore.

Why We Chose a Graph Instead of Another List

Traditional lists are useful when you need to know what you have.

Graphs become especially useful when you need to understand how things are connected.

Consider a simplified investigation:

Suspicious Domain
demo.example

RESOLVES_TO

IP Address
192.0.2.10 · documentation-only example IP

MENTIONED_IN

Intelligence Report
REPORT-001 · synthetic demonstration data

Illustrative graph path based on the project's synthetic demonstration data, not a real threat finding.

In FalkorDB, these connections can be represented as relationships between nodes and retrieved using graph queries.

GraphGuard AI's model includes paths such as:

Domain → RESOLVES_TO → IPAddress
Domain → PRESENTED_CERTIFICATE → Certificate
IPAddress → MENTIONED_IN → Report

This structure lets an investigation move beyond a single indicator and inspect the related entities that the graph contains.

The difference is important: the graph does not automatically establish guilt. It gives the analyst more context to evaluate.

Under the Hood: Turning Connections into Context

The investigation begins when a user submits a domain through the dashboard.

The backend receives the request and queries FalkorDB for matching graph entities and their relationships. The returned information can include associated IP addresses, certificate records, and intelligence-report references when those records exist in the graph.

The application then presents the available findings to the user.

The process follows a clear path:

Indicator → Graph Query → Connected Evidence → Analyst Review

FalkorDB is central to this workflow because the investigation depends on retrieving connected entities, not merely storing unrelated records.

The project also explores the wider possibility of passive intelligence enrichment, including DNS, registration information, certificate transparency, and public threat-intelligence sources. Any live enrichment must be distinguished from existing graph records so that users can tell where each observation originated.

The Most Important Feature Is What We Don't Claim

In cybersecurity, an incorrect conclusion can be more dangerous than an incomplete result.

Two domains sharing an IP address does not automatically make them malicious. A certificate connection does not prove an attack. A mention in a report must be interpreted in context.

That is why GraphGuard AI is designed around an evidence-first principle:

A connection is a lead. Evidence supports a hypothesis. Verification builds confidence.

The prototype's synthetic dataset demonstrates the investigation workflow; it is not proof of real-world detection accuracy. Likewise, any confidence value shown by the application should not be mistaken for a statistically validated probability of maliciousness.

Our aim is to help users follow the evidence, understand the relationships, and decide what deserves further investigation—not to replace human judgment with an unexplained verdict.

Building Under Hackathon Pressure

Graph Hacks 2026 gave us an opportunity to turn a concept into a working prototype within a short development window.

As Team SynapGraph, we focused on connecting the database, backend API, and dashboard into one locally runnable application.

The process involved more than writing code. We needed to think about the graph data model, how relationships should be queried, how findings should be presented, and how someone else could run the project.

We used AI-assisted development tools to accelerate parts of the workflow while keeping the project's actual implementation and limitations in view.

One lesson stood out: a project becomes much easier to explain when the architecture follows a clear idea. For GraphGuard AI, that idea is the relationship between an indicator and the evidence surrounding it.

What Comes Next: From Connected Data to Better Investigations

GraphGuard AI is a starting point, not a finished security platform.

Future work could explore:

More passive intelligence providers and clearly attributed observations.
Stronger provenance, freshness, and source-quality indicators.
Additional graph traversal and relationship analysis.
More comprehensive tests using carefully labelled datasets.
Better ways to explain why a particular connection is relevant.
Evaluation against known examples to measure where the approach succeeds and fails.

The long-term goal is not simply to produce a larger graph. It is to make the graph more useful to the person investigating it.

See the Project in Action

Explore the source code:

https://github.com/sudhir734/GraphGuard-Ai

Watch the demo:

https://youtu.be/gMyqtCTPSv8

GraphGuard AI is a hackathon prototype intended for demonstration and experimentation. Its findings should be independently verified before use in operational security decisions.

One Final Thought

A suspicious domain is a starting point, not a conclusion.

The real investigation begins when we ask what connects to it, what those connections actually mean, and which pieces of evidence deserve our attention.

With GraphGuard AI, we are exploring a simple but powerful idea: cybersecurity is not only about finding signals. It is about understanding the relationships between them.

Follow the connections. Question the evidence. Investigate with context.

Team SynapGraph | Graph Hacks 2026

DEV Community: Sudhir Gunnam

The Domain Was Just the Beginning: Building GraphGuard AI with FalkorDB

The Domain Was Just the Beginning: Building GraphGuard AI with FalkorDB

Every Threat Leaves a Trail. Can You Connect It?

Meet GraphGuard AI: An Investigation That Follows the Connections

Why We Chose a Graph Instead of Another List

Under the Hood: Turning Connections into Context

The Most Important Feature Is What We Don't Claim

Building Under Hackathon Pressure

What Comes Next: From Connected Data to Better Investigations

See the Project in Action

One Final Thought