Investigate: Examining Raw Events in the Events View

Analysts can view and reconstruct events associated with a session in Investigate.

• If you have the appropriate system roles and permissions set up for your user accounts, you can go from a Navigate view drill point to the Events view.
• If you do not have access to the Navigate view or want to go directly to the Events view, you can open sessions and examine the events that make up the session in the Events view.
• You can select queries from your query history.

These topics describe methods of working in the Events view:

• Add Events to an Incident for Response
• Manage Column Groups in the Events View
• Export Events in the Events View
• Add Events to an Incident for Response
• Combine Events from Split Sessions

You can also use these methods of querying data and acting on results that are common to the Navigate view and the Events view.

• Use Profiles to Encapsulate Common Areas for Investigation
• Search for Text Patterns
• Create a Custom Query
• View and Modify Queries Using URL Integration
• Manage Context Hub Lists and List Values in the Navigate and Events Views

• Look Up Additional Context for a Data Point

• Reconstruct an Event