Investigate: Event Analysis View - File Analysis Panel

Version 15Show Document

In the File Analysis panel (Event Analysis > File Analysis), you can safely view a list of files and download one or more files in an event.

Workflow

User Role	I want to ...	Show me how
Threat Hunter	browse event metadata	Begin an Investigation in the Navigate or Events View
Threat Hunter	browse raw events	Begin an Investigation in the Navigate or Events View
Threat Hunter	analyze raw events and metadata	Begin an Investigation in the Event Analysis View
Threat Hunter	query events in the Event Analysis view (Version 11.1)	Filter Results in the Event Analysis View
Threat Hunter	export events and files in the Event Analysis view*	Download Data in the Event Analysis View
Threat Hunter	reconstruct events in Event Analysis view	Examine Events in the Event Analysis View
Threat Hunter	perform external lookups from the Event Analysis view (Version 11.1)	Act on Data in the Event Analysis View
Threat Hunter	query events in the Navigate view	Investigating Metadata in the Navigate View
Threat Hunter	query events in the Events view	Examining Raw Events in the Events View
Threat Hunter	investigate endpoints (Version 11.1)	Investigate Hosts
Threat Hunter	find suspicious endpoint files (Version 11.1)	Investigate Files
Threat Hunter	scan files and events for malware	Conducting Malware Analysis
Incident Responder	triage an incident in Investigate	NetWitness Respond User Guide

*You can perform this task in the current view.

The File Analysis panel displays a list of files associated with a network event. You can download files in this view.

Below is an example of the File Analysis panel with labeled features.

Note: The Email and Web reconstruction types at the top of the figure are available in Version 11.1 and later.

1	Click to download one or more selected files.
2	The Event Header displays summary information for the network event that contains the files.
3	Scrollable list of associated files that you can select and download.
4	Reminder that caution is necessary when downloading potentially malicious files.

You are here