Investigate: Event Analysis View - File Analysis Panel

Version 17Show Document

In the File Analysis panel (Event Analysis > File Analysis), you can safely view a list of files and download one or more files in an event.

Workflow

User Role	I want to ...	Show me how
Incident Responder	review critical incidents or alerts	NetWitness Respond User Guide
Threat Hunter	query a service, metadata, and time range	Filter Results in the Event Analysis View Filter Results in the Navigate View Create a Custom Query Filter and Search Results in the Events View
Threat Hunter	view metadata	Examine Events in the Event Analysis View Investigating Metadata in the Navigate View
Threat Hunter	view raw event data	Examine Events in the Event Analysis View Examine Events in the Event Analysis View Examining Raw Events in the Events View
Threat Hunter	reconstruct the event	Examine Events in the Event Analysis View Reconstruction Types in the Event Analysis View Reconstruct an Event
Threat Hunter	examine files*	Download Data in the Event Analysis View Reconstruct an Event
Threat Hunter	perform lookups	Act on Data in the Event Analysis View Look Up Additional Context in the Event Analysis View Launch an External Lookup of a Meta Key Look Up Additional Context for a Data Point
Threat Hunter	create an incident or add to an incident	Add Events to an Incident for Response
Threat Hunter	add a meta value to a Context Hub list	Look Up Additional Context in the Event Analysis View Look Up Additional Context for a Data Point Manage Context Hub Lists and List Values in the Navigate and Events Views

*You can perform this task in the current view.

The File Analysis panel displays a list of files associated with a network event. You can download files in this view.

Below is an example of the File Analysis panel with labeled features.

Note: The Email and Web reconstruction types at the top of the figure are available in Version 11.1 and later.

1	Click to download one or more selected files.
2	The Event Header displays summary information for the network event that contains the files.
3	Scrollable list of associated files that you can select and download.
4	Reminder that caution is necessary when downloading potentially malicious files.