In the Email panel (Events > Email), you can view a list of email received and associated attachments for an event.
- How NetWitness Investigate Works
- Events View
- Events View - Text Panel
- Events View - Packet Panel
- Events View - File Panel
The Email panel displays a list of emails associated with a network event. When an analyst opens the email, the email reconstruction is displayed along with the associated attachments and additional header details, if any.
The following figure highlights the features of the email reconstruction.
|1||Displays the details of the selected event.|
Displays the details of the email header.
|3||Clicking this expands and collapses the email.|
|4||Displays the content of the email.|
|5||ClickingShow Remaining % displays the complete email.|
The following table describes all the fields within an email.
|From||Displays the email address of the sender of the email.|
|To||Displays the email addresses of the recipients of the email.|
|CC (Carbon Copy)||Displays email addresses of additional recipients of the email. The field is displayed only if the sent email has any value and the email addresses are visible to the recipient.|
|BCC||Displays email addresses of additional recipients privately. This field is displayed only if the sent email has any value and the email addresses are not visible to the recipient.|
|Subject||Displays the subject of the email.|
Displays any files shared by the sender that can be downloaded by the recipient. This field is displayed only if email contains attachments.
Additional Header Details
Provides additional details of the email event such as Received, Sender, Message-ID and others.