Investigate: Events View - File Panel

Version 22Show Document

In the File panel (Events > File), you can safely view a list of files and download one or more files in an event.

Workflow

This workflow has references to several views that were renamed in Version 11.4: Event Analysis --> Events, Events --> Legacy Events.

User Role	I want to ...	Show me how
Incident Responder	review critical incidents or alerts	NetWitness Respond User Guide
Threat Hunter	query a service, metadata, and time range	Filter Results in the Events View Filter Results in the Navigate View Create a Query in the Navigate and Legacy Events Views Filter Results in the Legacy Events View
Threat Hunter	view metadata	Analyze Events in the Events View Refining the Results Set
Threat Hunter	view raw event data	Filter Results in the Events View Analyze Events in the Events View Filter Results in the Legacy Events View
Threat Hunter	reconstruct the event	Analyze Events in the Events View Reconstruct an Event in the Events View Reconstruct an Event in the Legacy Events View
Threat Hunter	examine files*	Download Data in the Events View Export or Print a Drill Point in the Navigate View Export Events in the Legacy Events View
Threat Hunter	perform lookups	Look Up Additional Context for Results Launch a Lookup of a Meta Key
Threat Hunter	create an incident or add to an incident	Add Events to an Incident in the Legacy Events View Add Events to an Incident in the Events View
Threat Hunter	add a meta value to a Context Hub list	Look Up Additional Context for Results

*You can perform this task in the current view.

The File panel displays a list of files associated with a network event. You can download files in this view.

Below is an example of the File panel with labeled features.

Note: The Email and Web reconstruction types at the top of the figure are available in Version 11.1 and later.

1	Click to download one or more selected files.
2	The Event Header displays summary information for the network event that contains the files.
3	Scrollable list of associated files that you can select and download.
4	Reminder that caution is necessary when downloading potentially malicious files.

Previous Topic:Events View

You are here