Analysts who are using RSA Security Analytics Investigation to view and reconstruct events have several customization options for the view, and can export files associated with an event.
- Analysts who conduct analysis using Security Analytics Investigation, and have the appropriate system roles and permissions set up for their user accounts, can go from a Navigate view drill point to the Events view.
- Analysts who do not have access to the Navigate view or want to go directly to the Events view, can open sessions and examine the events that make up the session in the Investigation > Events tab.
Separate topics describe the possible procedures.
- Combine Events from Split Sessions
- Export Events and Extract Files
- Filter and Search Results in the Events View
- Manage Column Groups in the Events View
- Reconstruct an Event