Warehouse Analytics: Step 5. Investigate a Warehouse Analytics Report

Document created by RSA Information Design and Development on Sep 11, 2017Last modified by RSA Information Design and Development on Oct 16, 2017
Version 4Show Document
  • View in full screen mode
 

Note: Warehouse Analytics is not supported in Netwitness Suite 11.0 release.

You can identify early indicators of compromise by investigating from Warehouse Analytics Reports. You can investigate the suspicious domains and internal hosts activities in the network. For more information see Suspicious Domains and Host Profile sections in How Warehouse Analytics Works.

To investigate, you can do one of the following:

  • Use the Investigate option on the main menu.
  • Use the Navigate option on the View Job view.

Perform the following steps.

  1. In the main menu, click Reports.

    The Manage tab is displayed.

  2. Click Warehouse Analytics.
    The Warehouse Analytics view is displayed.
    Warehousre Analytics View in Reports

  3. In the Warehouse Analytics toolbar, click View All Jobs.

    The View All Jobs tab is displayed..

    Note: If no jobs are displayed in the View All Jobs, select a date for which you want to display the jobs.

  4. Double-click the Job execution to view the job details on the View a Job tab. For more information, see View All Jobs Panel

     


  5. From the Investigate column, click Navigate.

    The Investigate a Service dialog box is displayed.

    Investigate a Service dialog box

  6. Select the service, for example Concentrator service.
  7. Click Navigate.

    The Navigate View is displayed.


  8. Select a data point on the Navigate view.
You are here
Table of Contents > Configure Reports using Warehouse Analytics > Investigation from Warehouse Analytics Reports

Attachments

    Outcomes