Investigate: Examining Raw Events in the Events View

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Sep 11, 2018
Version 14Show Document
  • View in full screen mode
 

Analysts who are investigating data in Investigate can view and reconstruct events associated with a session.

  • Analysts who conduct analysis using NetWitness Platform Investigate, and have the appropriate system roles and permissions set up for their user accounts, can go from a Navigate view drill point to the Events view.
  • Analysts who do not have access to the Navigate view or want to go directly to the Events view, can open sessions and examine the events that make up the session in the Events view.
  • Analysts can select queries from their "query history" window.

Separate topics describe methods of working in the Events view:

In addition, you can use these methods of querying data and acting on results that are common to the Navigate view and the Events view.

 

You are here
Table of Contents > Examining Raw Events in the Events View

Attachments

    Outcomes