Investigation - Manage Column Groups Dialog

Document created by RSA Information Design and Development on Mar 23, 2017Last modified by RSA Information Design and Development on Apr 10, 2017
Version 2Show Document
  • View in full screen mode

In Manage Column Groups dialog, you can add, delete, import, export, and edit column groups to display specific meta keys.

To access this dialog:

  1. In the Security Analytics menu, select Investigation > Events.
    The Investigate dialog is displayed.
  2. Select a service and click Navigate.
  3. In the toolbar, select Detail View > Manage Column Groups.
    The Manage Column Groups dialog is displayed.


OOTB Column Groups

At fresh installation, OOTB column groups are added for investigation in the Manage Column Groups dialog. The OOTB column groups are prefixed with RSA for identification and can be duplicated but cannot be edited or deleted.

Custom Column Groups

The Custom Column groups drop-down are added for investigation in the Custom Column Groups dialog. The Custom Column groups lists all the custom and the OOTB column groups.

To access this dialog:

  1. In the Security Analytics menu, select Investigation > Events.
    The Investigate dialog is displayed.

  2. Select a service and click Navigate.

  3. In the toolbar, select Detail View > Custom Column Groups.
    The Custom Column Groups drop-down is displayed.

Related procedures are available in Manage Column Groups in the Events View.


The Manage Column Groups dialog has two panels: Groups and Settings.

At the bottom of this dialog are four buttons: Close, Cancel, Save, and Save and Apply. The following table provides descriptions of these buttons.

CloseCloses the dialog without saving.
CancelCancels all unsaved changes.
SaveSaves all changes without closing the dialog.
Save and ApplySaves and applies all changes immediately, closing the dialog.

Groups Panel

The left panel is the Groups panel. This is where you can add, delete, import, or export column groups. At the top of the panel is a toolbar which provides actions. Below the toolbar is a list of added column groups, where you can select one or more groups.

The following table lists the actions in the toolbar.

Add icon Adds a column group. Clicking this button highlights the Settings panel on the right, where you can name the column group and add or delete meta keys. At least one meta key is required to add a group.
Delete icon Deletes a column group. A confirmation dialog is displayed before the selected group is deleted.
Import.png Displays the Import Column Groups dialog, where you can select a file to upload.
Export.png Exports one or more selected groups to your computer.

Settings Panel

The right panel is the Settings panel. This is where you can create and edit column groups. This panel contains the Name field, a toolbar, and a grid.

The following table describes the features of the Settings panel.

NameThe name of the selected column group.
Add icon Adds a new row to the list of meta keys, where you can open a drop-down menu to select a new meta key.
Delete icon Deletes one or more selected meta keys. Displays a confirmation dialog before deleting.
ResetReturns column group to its most recently saved settings.
Meta KeyLists the meta keys added to the selected column group.
Display NameLists the names of the meta keys as they will be displayed in the Events view.
WidthSpecifies the width of each meta key's column. The width can be set between 10 and 1000. The default width is 100.
You are here
Table of Contents > Investigation Reference Materials > Manage Column Groups Dialog