Investigate: Examining Raw Events in the Events View

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Apr 25, 2019
Version 16Show Document
  • View in full screen mode
 

Analysts can view and reconstruct events associated with a session in Investigate.

  • If you have the appropriate system roles and permissions set up for your user accounts, you can go from a Navigate view drill point to the Events view.
  • If you do not have access to the Navigate view or want to go directly to the Events view, you can open sessions and examine the events that make up the session in the Events view.
  • You can select queries from your query history.

These topics describe methods of working in the Events view:

You can also use these methods of querying data and acting on results that are common to the Navigate view and the Events view.

 

You are here
Table of Contents > Examining Raw Events in the Events View

Attachments

    Outcomes