Investigate: Examining Events

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Oct 24, 2017
Version 8Show Document
  • View in full screen mode

Analysts who are investigating data in the Investigate can view and reconstruct events associated with a session.

  • Analysts who conduct analysis using NetWitness Suite Investigate, and have the appropriate system roles and permissions set up for their user accounts, can go from a Navigate view drill point to the Events view.
  • Analysts who do not have access to the Navigate view or want to go directly to the Events view, can open sessions and examine the events that make up the session in the Investigation > Events view.
  • Analysts can select queries from their "query history" window.

Separate topics describe methods of working in the Events view:

You are here
Table of Contents > Conducting an Investigation > Examining Events