This topic describes the features available in the Investigation > Events view > Event Reconstruction panel.
By default, Security Analytics displays the best reconstruction for the event determined by the event content or the reconstruction that you have selected in the Default Session View setting for Investigation. You can use the options in the Event Reconstruction toolbar to change the reconstruction method, view side-by-side results, export an event, open an email attachment, extract files, and open the event in a new tab.
To access this panel in a new tab, do one of the following:
- In the Events view, select an event to reconstruct and select Actions > View Event> Open in New Tab.
- In the Event Reconstruction toolbar of previewed reconstruction, click Open Event in New Tab in the toolbar.
The Event Reconstruction is displayed in a new tab.
To access this panel in the current tab, do one of the following:
- At the end of the event, select
- Select an event to reconstruct and select Actions > View Event > Preview Inline.
The Event Reconstruction panel opens in a popup window in the same view.
The Event Reconstruction panel has a toolbar at the top with the following options.>
|Request & Response||Displays a drop-down menu for selecting whether the panel displays:|
|Organization||Displays a drop-down menu for selecting whether the information is displayed top to bottom or side by side.|
|View||Displays a drop-down menu for selecting what information is displayed. By default, Best Reconstruction is selected. Other options are:|
|Actions||Displays a drop-down menu with the actions available in the Event Reconstruction panel.|
|Open Event in New Tab||Opens the event in a new browser tab.|
Beneath the toolbar is a list of meta keys and values. Some of the keys offer a drop-down menu with available actions.
The bar at the bottom of the panel offers several options.