Investigate: Examining Raw Events in the Events View

Analysts who are investigating data in Investigate can view and reconstruct events associated with a session.

• Analysts who conduct analysis using NetWitness Platform Investigate, and have the appropriate system roles and permissions set up for their user accounts, can go from a Navigate view drill point to the Events view.
• Analysts who do not have access to the Navigate view or want to go directly to the Events view, can open sessions and examine the events that make up the session in the Events view.
• Analysts can select queries from their "query history" window.

Separate topics describe methods of working in the Events view:

• Filter and Search Results in the Events View
• Manage Column Groups in the Events View
• Export Events in the Events View
• Add Events to an Incident for Response
• Combine Events from Split Sessions

In addition, you can use these methods of querying data and acting on results that are common to the Navigate view and the Events view.

• Search for Text Patterns
• Create a Custom Query
• View and Modify Queries Using URL Integration
• Use Profiles to Encapsulate Custom Views
• Manage Context Hub Lists and List Values in the Navigate and Events Views

• Look Up Additional Context in the Navigate and Events Views

• Reconstruct an Event