Investigation: Manage User-Defined Meta Groups

Document created by RSA Information Design and Development on Mar 23, 2017Last modified by RSA Information Design and Development on Apr 10, 2017
Version 2Show Document
  • View in full screen mode

In the Investigation > Navigate view, you can define meta groups for filtering data displayed in an investigation. This section describes how to add, edit, import, export, and delete custom meta groups to be used during navigation on a specific service. In a Parallel Coordinates visualization, the meta keys in a group appear as axes from left to right. Custom meta groups are visible to all users of a service and may be exported for import to any service, limited by the available meta keys for that service.

Note: When an administrator adds custom meta groups manually by editing the custom index file for a service, the new groups become available to Investigation after the service is restarted.

Create a Meta Group and Add Meta Keys

  1. While investigating a service in the Investigation > Navigate view, select Meta > Manage Meta Groups in the toolbar.
    The Manage Meta Groups dialog is displayed. Initially no groups are configured for a service. If groups have already been configured, they are listed under Group Name.
  2. In the grid toolbar, click Icon-Add.png.
    A new row is inserted at the top of the Meta Groups grid.
  3. Type a name for the new meta group, and press Enter.
    The form to the right opens for editing.
  4. (Optional) If you want to change the name of meta group, type a new value in the Name field.
  5. In the Meta Keys toolbar, click Icon-Add.png.
    The Available Meta Keys dialog is displayed, with keys in alphabetical order.
  6. To filter the list of meta keys, type a word or phrase in the Filter field and select Enter.
    The list displays matching meta keys based on a case-insensitive search. Delete the filter text and press Enter to remove the filter.
  7. To select meta keys to include in the meta group, click the checkboxes. To select all meta keys, click the checkbox in the title bar and click Add.
    The selected meta keys are added to the meta keys list.
  8. (Optional) If you want to change the order in which the meta keys load and are listed in an investigation, click and drag one or more meta keys to a new position.
  9. To finish creating the meta group do one of the following:
    1. To save the meta group, click Save.
      The group is created and available for use.
    2. To save and apply the meta group to the current Investigation view, click Save and Apply.
      The group is created and applied immediately to the current Investigation view.
  10. Click Close.

Edit a Meta Group

  1. Select a group from the Meta Groups grid.
    The form to the right opens for editing.
  2. (Optional) Edit the Name of the group.
  3. (Optional) Add new meta keys, as described above in Create a Meta Group and Add Meta Keys.
  4. (Optional) To set the order for the keys, drag and drop one or more keys.
  5. (Optional) To change the initial view of a meta key, click ViewOption.png and choose one of the possible views.
    When you modify the meta group, you cannot set the key to OPEN. If you change the default view for a group of meta keys to OPEN and some of the meta keys are non-indexed, the non-indexed meta keys revert to AUTO. As a result, the meta key is automatically loaded only if it is indexed, and non-indexed meta keys are CLOSED until opened manually.
    The value for the initial view is displayed in the View column.
  6. To save, the changes, click Save.
  7. To apply the changes to the current Navigation view, click Save and Apply.

Delete a Meta Group

  1. In the Meta Groups grid, select the group to be removed.
  2. Click Icon_Delete_sm.png.
    A confirmation dialog provides an opportunity to cancel or complete the request.
  3. Click OK.
    The meta group is deleted. When you close the window, if the deleted group was the currently applied meta group, it is removed and the default meta keys are used to build the view.

Export a Meta Group

User-defined meta groups are created on individual services. To make meta groups available to another service, you must export them to your local file system. To export one or more meta groups:

  1. In the Meta Groups grid, select one or more groups to be exported.
  2. Click ExportMetaGroup.png.
    The selected groups are downloaded to your local file system as a MetaGroups.jsn file. Every download of meta groups has the same name with a numeral appended to avoid overwriting previous downloads.

Import a Meta Group

To make user-defined meta groups from another service available to the currently investigated service, you must import the MetaGroups.jsn file from the local file system. To import meta groups:

  1. In the Meta Groups grid, select a file to export and click ImportMetaGroup.png.
    The selection dialog is displayed.
  2. Click Browse and navigate to the directory on your local file system where the downloaded MetaGroups.jsn files are stored. Select a file and click Open.
    The filename is displayed in the Upload File field.
  3. Click Upload.
    The upload process begins, and a message indicates that the upload was successful. The meta groups are added to Meta Group grid. If the file is a duplicate of an existing meta group, a dialog tells you that the meta group already exists.

For information on OOTB Meta Groups, see Investigation - Manage Meta Groups Dialog.

You are here
Table of Contents > Conduct an Investigation > Filter Information in the Navigate View > Manage User-Defined Meta Groups