1. A method, comprising: receiving a query that comprises a selection of Internet protocol (IP) addresses belonging to nodes within a network; obtaining characteristics for the nodes; determining communications between the nodes and communications between the nodes and any other nodes not included in the selection of IP addresses; determining a primary affinity indicative of the communications between the nodes and a secondary affinity indicative of the communications between the nodes and the other nodes not included in the selection of IP addresses, the primary affinity and the secondary affinity further indicative of a frequency of communications between nodes; generating a graphical user interface (GUI) that comprises representations of the nodes in the selection of IP addresses and the other nodes not included in the selection of IP addresses; placing links between the representations of the nodes in the selection of IP addresses and the representations of the other nodes not included in the selection of IP addresses based on the primary affinity and the secondary affinity; providing the GUI to a user; applying at least one of a cyber security policy or a network ruleset; altering the representations for nodes that fail to comply with the cyber security policy or the network ruleset such that the representations are visually distinct compared to the nodes that comply with the cyber security policy or the network ruleset; receiving user input associated with either one of the nodes or one of the links; and sending a message in response to the user input, the message including instructions to bring at least one of the nodes that fail to comply with the cyber security policy or the network ruleset into compliance with the cyber security policy or the network ruleset.