Analysts who are investigating data in the Investigate can view and reconstruct events associated with a session.
- Analysts who conduct analysis using NetWitness Suite Investigate, and have the appropriate system roles and permissions set up for their user accounts, can go from a Navigate view drill point to the Events view.
- Analysts who do not have access to the Navigate view or want to go directly to the Events view, can open sessions and examine the events that make up the session in the Investigation > Events view.
- Analysts can select queries from their "query history" window.
Separate topics describe methods of working in the Events view:
Previous Topic:View Additional Context for a Data Point
Next Topic:Filter and Search Results in the Events View
You are hereTable of Contents > Conducting an Investigation > Examining Events