Investigate: Navigate View

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Oct 24, 2017
Version 8Show Document
  • View in full screen mode
 

The Navigate view ( INVESTIGATE > Navigate) is the primary entry point to NetWitness .Investigate. The Navigate view displays the activity and values for the selected service in accordance with the Investigation options set: profile, time range, meta group, and query. As analysts investigate events of interest, the meta keys and values are displayed.

Workflow

The workflow below depicts the high-level steps and subtasks for investigating events.

Basic workflow for Investigate

These are the tasks that you can perform in the Navigate view:

  • Select a service to investigate and load data.
  • View query results and filter by time range, profile, meta group.
  • Sort the results and select a quantification method.
  • Save events, go to an event using the event ID, visualize an event, and print the event.
  • View additional contextual data for specific meta keys and values.
  • Go to the Events view, where you can see a chronological list of events, reconstruct an event, and conduct an interactive analysis of an event. When viewing and analyzing events, you can export events, files, and logs to your local file system.

What do you want to do?

                                                                    
User RoleI want to ...Documentation
Threat Huntersubmit a query or drill into the data set* Querying Data in the Navigate View

Threat Hunter

set user preferences for Investigate*

Configuring Investigation Views and Preferences

Threat Hunterrefine query results* Refining Results Displayed in the Navigate View

Threat Hunter

open a drillpoint in the Events view*

Open the Events List

Threat Huntervisualize an event* Drill into Data in the Navigate View Time Chart
Threat Hunterexport or print a drill point, launch an external lookup or Malware Analysis scan* Acting on a Drill Point in the Navigate View
Threat Hunterlook up additional context of an event* View Additional Context for a Data Point
Threat Hunterview a reconstruction of an eventReconstruct an Event

Threat Hunter

view interactive Event Analysis

Analyze Events in the Event Analysis View

Threat HunterConduct Malware AnalysisConducting Malware Analysis

Incident Responder

investigate an incident

NetWitness Respond User Guide

*You can perform this task in the current view.

Related Topics

Quick Look

This is the Navigate view.

The Navigate view consists of these features:

  • Toolbar
  • Pause/reload button and breadcrumb
  • Time banner
  • Optional debug information.
  • Collapsible Visualization panel
  • Values panel
  • Context Lookup panel
  • Context menus

Toolbar

The toolbar provides a way to:

  • Change the service being investigated.
  • Control the range of data displayed: You can select use profiles, set a time range, use meta groups, and create queries to apply to the data.
  • Set the quantification method and sorting method for data in the Values panel.
  • Perform actions on the results. You can export and print results, navigate to an event for which you have an event ID, and pass a query to Informer.
  • Configure Investigation settings without navigating away from the Investigation views.

Some of the toolbar options are labeled with the default value or the selected value rather than displaying the name of the option. For example, the time range option in the example above is labeled Last 5 Minutes to reflect the currently selected value. These are the toolbar options.

                                                           
OptionDescription
Service icon Displays the selected service name next to the icon. Clicking the icon opens the Investigate a Service dialog, in which you can select a service to investigate and set the default service to investigate (see Beginning an Investigation of a Service or Collection). Changing the service does not cause a reload of the data.
Time Range Displays the Time Range options; the currently selected option is displayed in the toolbar (see Set the Time Range for an Investigation). Possible choices are:
  • All Data
  • Last 5, 10, 15, or 30 Minutes
  • Last Hour, Last 3, 6, 12, or 24 Hours
  • Last 2 or 5 Days
  • Early Morning
  • Morning
  • Afternoon
  • Evening
  • All Day
  • Yesterday
  • This Week
  • Last Week
  • Custom

Note: If you specify custom start or end times in seconds, the value for start time in seconds always defaults to :00, and the value for end time in seconds always defaults to :59. For example, if you are using time to drill down into an issue, the drill time will be interpreted as HH:MM:00 - HH:MM:59. Seconds display in this format in Investigation > Navigate functions.

Query Displays the Query dialog, in which you can enter a custom query directly instead of drilling down the data. See Query Dialog for a description of the dialog.
Profile Displays the Profile menu; the currently selected profile is displayed in the toolbar. A profile allows you to manage and use profiles that can include custom meta groups, a default column group, and a beginning query. The Profiles apply to the Navigate view (meta groups and queries) and the Events view (column groups and queries). See Use Investigation Profiles to Encapsulate Custom Views for more information.
MetaDisplays the Meta Group menu. You can use Default Meta Keys or a custom Meta Group. You also have the option to make changes to both group types (see Manage Meta Groups).
Sort FieldDisplays the Sort Field menu; the currently selected option is displayed in the toolbar. The menu has two options: Order by Total and Order by Value. The Sort Field is a complement to the Sort Order option; the data for each meta key is ordered based on the total (green number) or the meta value (blue text) (see Set the Quantification Method and Sort Sequence of Meta Key Results).
Sort Order Displays the Sort Order menu; the currently selected option is displayed in the toolbar. The menu has two options: Sort in Ascending Order and Sort in Descending. The Sort Order is a complement to the Sort Field option; the selected field for each meta key is ordered in ascending or descending order (see Set the Quantification Method and Sort Sequence of Meta Key Results)).
Quantification Method  Displays the Quantification Method menu; the currently selected option is displayed in the toolbar. The Quantification Method only applies to the meta key results in the Values panel. It does not apply to the timeline.
The drop-down menu contains three options for calculating the quantity (green number in parentheses) for a meta value: Quantify by Event Count, Quantify by Event Size, and Quantify by Packet Count (see Set the Quantification Method and Sort Sequence of Meta Key Results)).
These are applied differently depending on the type of data in view.
For packet data:
  • Quantify by Event Count shows the number of sessions.
  • Quantify by Event Size shows the size in bytes.
  • Quantify by Packet Count shows the number of packets.
For log data:
  • Quantify by Event Count shows the number of logs.
  • Quantify by Event Size shows the size in bytes.
  • Quantify by Packet Count shows the number of logs.
Save EventsDisplays the Save Events menu, in which you can use options to: extract files associated with an event, export the current drill point as a PCAP file, and export the current drill point as a log file (see Export a Drill Point).
Actions The Actions menu includes various actions (Visualize, Go To Event, and Print) that you can perform in the Navigate view (see Acting on a Drill Point in the Navigate View).
Search Events Enables you to search for text patterns within the current set of events. If you click in the Search field, it shows a drop-down menu with search options. If you click Apply, it saves the selected options and also updates the search options in the Events view and the Investigations profile (see Search for Text Patterns in the Investigate View).
SettingsDisplays the Investigation settings for the Navigate view (which are also editable in the Profile view) so that you can change Investigation settings without navigating away from the Navigate view. When you change a setting In the Navigate view the setting is also changed in the Profile view (see Configure Navigate View and Events View).

Pause/Reload Button and Breadcrumb

The breadcrumb tracks each query as you drill down through the metadata for the service. Each query is listed with a drop-down menu in a pipe separated string. The last point is the current point, also called the tip. The icon in front of the breadcrumb allows you to pause the loading of meta values and to reload meta values.

The breadcrumb does not include the service name and appears only if a query is in effect. If too many drill points exist for display, the overflow is shown as double angle brackets, >>, at the end of the breadcrumb.

Each drop-down menu in the breadcrumb is the same, with slight variation based on the position of the crumb.

The following table describes the controls and menu options in the breadcrumb.

                                           
FeatureDescription
Pause icon
Pause and Reload button. Controls the loading of data in the view. It has three possible functions: pause loading, continue loading, and reload.
Navigate HereOpens the selected drill point in the current Values panel.
Navigate Here (new tab)Opens the selected drill point in a new tab.
Insert BeforeInserts a query before the current drill point. The Create Filter dialog opens and you can define a custom query to insert in the breadcrumb (see Create a Custom Query).
Append Appends a query after the current drill point. The Create Filter dialog opens and you can define a custom query to append to the end of the breadcrumb (see Create a Custom Query).
RemoveRemoves the selected drill point from the breadcrumb.
Edit Opens the selected drill point in the Create Filter dialog so that you can edit the query.
>> Clicking the angle brackets displays a drop-down menu of the breadcrumb overflow.

(Optional) Debug Information

If you have activated the Show Debug Information setting and the service you are navigating is a 10.4 or later Broker, NetWitness Suite displays the debug information beneath the breadcrumb.

The debug information is the where clause from the current query. The only time there is no where clause is when the time range is all data and there are no drill points. If the Broker has at least one aggregate service that is offline, the debug information also lists the offline service.

For example:

(attachment exists)&&(tcp.dstport = '80')&&(risk.info exists)$$time='2014-05-04 18:50:00"-"2014-05-09 18:59:59(attachment exists) && (tcp.dstport = '80') && (risk.info exists) && time="2014-05-04 18:50:00"-"2014-05-09 18:50:59"

In addition, the time taken to load is displayed at the end of each meta key in the Values panel.

Time Banner

Just below the breadcrumb and debug information (if present), the time banner shows the time range used to create the chart.

Visualizations

At the top of the Navigate view is a visualization of the current drill point. You can use this to drill into data from the Visualization panel (see Drill into Data in the Navigate View Time Chart). You can show or hide the visualization, and choose one of the the visualization options: Timeline or Coordinates. The Visualization opens initially to the last saved Visualization.

Timeline Chart

The timeline is the count of the number of events that occur at a specific instance. The timeline provides event counts so that you can see if the number of events increases drastically at a given point in time. The timeline displays activity for the specified service and time range as a line chart or a bar chart based on your choice in the Options menu. The second figure illustrates a line chart and third figure illustrates a bar chart.

Visualization Options dialog

example of a line chart

example of a bar chart

The timeline displays activity for the specified service and time range, as a line chart or a bar chart based on your choice in the Options menu.

                                       
FeatureDescription
Number of Events (Timeline) The Y axis of the chart based on thousands of events.
Time Line (Timeline) The X axis of the chart based on the time the events occurred.
Event point (Timeline) If you want to explore a specific section, simply select the range from the chart. The new time range will be reflected in the chart.
Investigate (Timeline) Displays the meta values for the selected subset.
Reset Zoom (Timeline) To return to the original time range, click Reset Zoom.
Options Displays the Visualization Options dialog. Data points can be displayed as a Line chart (default), a Bar chart, or Coordinates chart. When a chart type is select, the relevant options are displayed.
Hide Collapses the chart.

Parallel Coordinates Chart

The Parallel Coordinates chart is one of the choices in the Options menu for visualizing the current drill point. With Coordinates selected in the Visualization Options dialog, you can select the meta data to be displayed (see Visualize Metadata as Parallel Coordinates).

example of a parallel coordinates visualization

                                   
FeatureDescription
Axes Each axis is a meta key. The number of meta keys affects the load time for the chart. All meta keys are loaded, but it there the number of events per meta key is limited.
Lines Lines represent events and they connect values on the axes to show the correlation between multiple meta keys.
Options Displays the Visualization Options dialog. Data points can be displayed as a Line chart (default), a Bar chart, or Coordinates chart. When a chart type is select, the relevant options are displayed.
Only a subset of events is displayed. This message is a notification that not all events in the values panel are drawn in the chart. Removing axes or filtering the data in the Values panel can help to display all events.
Events Found | Unique Paths Displays the total number of events charted versus the number of unique paths charted. Setting the All Meta Keys Must Exist in an Event option redraws the chart so that it is more targeted and legible.
DNEIndicates that there is no values for this meta key in the event.

In the Visualization Options dialog for Coordinates, you can select the meta keys to chart.

                                               
FeatureDescription
Visualization selection Displays a drop-down list of visualization types: Timeline and Coordinates
All Meta Keys Must Exist in an Event Limits the data represented in the visualization to only those events that include all selected meta keys. This can result in a cleaner, more targeted visualization.
Add icon Displays the Add Keys to Parallel Coordinates Visualization dialog so that you can add axes to the visualization. This is useful if you are looking for relationships between the default meta keys and some additional ones.
Delete icon Deletes the selected keys so that they do not appear as axes in the visualization. This can help to make the visualization less cluttered and allow for more data points to be included in the visualization.
Reverse icon Reverts to the default meta keys for visualization, which consist of all meta keys in the current drill point.
Info icon Controls the display of additional information about the number of selected axes versus the recommended count. This helps to make you aware of possible performance improvements by removing axes.
Axes Lists the meta keys selected as axes in the visualization.
Cancel Cancels any changes made to the visualization options.
Apply Saves the changes made to the visualization options and applies to the current visualization.

In the Add Keys to Parallel Coordinates Visualization dialog, you can select the meta keys or meta groups to use as axes the Parallel Coordinates visualization.

                           
FeatureDescription
Visualization selection Select Keys: Two options for selecting meta keys are:
  • From Default Meta Keys
  • From Meta Groups
Each option offers a drop-down list from which to select.
With the Selected Meta Keys... The options for the method of adding meta keys allow you to:
  • Replace the current list of keys
  • Append to the current list of keys
  • Insert at beginning of the current list of keys
Cancel Closes the dialog and does not add any keys.
Add Closes the dialog and adds the selected keys as specified.

Values Panel

The major feature of the Navigate view is the Values panel, which you can use to analyze data (see Drill into Data in the Values Panel).

The default view is for the last 3 hours of collection, using the default meta keys and non-indexed meta keys closed. The meta keys within the meta groups are displayed in the order that NetWitness Suite queries the keys. As the data loads into the Values panel, NetWitness Suite is optimized to show partial results, loading progress, and service status as the data loads.

The loading behavior is determined by several configuration settings. The highest level settings are configured by the administrator for each user. These are:

  • The maximum amount of time allowed for this user to run a query (Query Timeout).
  • The limit at which NetWitness Suite stops counting the number of meta values in a sess(Session Threshold). If a threshold is set for a session, the Navigation view shows that the threshold was reached and the percentage of results loaded. Any session that does not show a percentage is accurate and was processed to completion. If there is a percentage, that reflects how much processing was completed. The percentage displayed is estimated by extrapolating from the value at the time processing finished, considering the amount of work remaining. Larger percentages are generally more accurate because they require less extrapolating
  • The limit at which NetWitness Suite stops counting the number of meta values in a session (Session Threshold). If a threshold is set for a session, the Navigation view shows that the threshold was reached and the percentage of query time used to reach the threshold.

Note: The values for non-indexed meta keys take longer to load in the Values panel. To optimize loading, NetWitness Suite does not open non-indexed meta keys by default. Refer to Manage and Apply Default Meta Keys in an Investigation for a detailed description of non-indexed meta keys in Investigation.

When you have launched an investigation of a service, NetWitness Suite displays results in the Values panel.

  1. NetWitness Suite loads meta keys and meta values in the Values panel. For each meta key load, the stages of load are:
    1. Waiting to Be Loaded or Closed. If Closed, no data for that key is loaded.
    2. Loading
      1. Loading progress: NetWitness Suite is receiving and displaying progress messages.
      2. Partial results: NetWitness Suite is receiving values messages and partial results are displayed in the Values panel.
    3. Load Complete: All results are finished loading.
  2. As each meta key load is completed, and final values are displayed, the next meta key is started. The number or values rendered for each meta key is specified by the Render Threads value in the Investigation Preference settings. Loading continues until all keys to be loaded have finished.
  3. If Show Debug Information is active and the service you are navigating is a 10.4 or later Broker, NetWitness Suite displays load time information beneath the values for each meta key and displays additional load details for the aggregated services. NetWitness Suite also displays the debug information beneath the breadcrumb.

Iterative results

Iterative results provide feedback on the status of queries within the interfaces to provide additional context for how long the data load will take and if any service data is missing. For example, if you are querying a Broker that is aggregating from two Concentrators, NetWitness Suite starts displaying the results from the first Concentrator as soon as it is available, even if the second Concentrator is still waiting for results.

Iterative results also include a notification that service data is missing because the service is unreachable.

Partial results

When partial values from the Core service are returned but not completed, a message at the end of the meta key listing shows the progress of values loaded. For example, Currently looking at 38 ip.src values 71% indicates that loading of values for the meta key is 71% complete.

Debug Information

If the Show Debug Information setting is in effect, a field at the end of the values displays the status for the different systems against which you are querying within NetWitness Suite. For example, when you are querying against a 10.4 broker pulling from multiple concentrators, NetWitness Suite displays the status of the query on each of the Concentrators, which provides insight into the relative speed of data loading from each of the Concentrators. Each service that participated in the query is listed with the total elapsed time for the query.

Each service that participated in the query is listed with the total elasped time for the query. In the example above, two services returned in 3.207 seconds, localhost:50005 took 2 seconds to return the results. In addition, the where clause of the query is displayed below the breadcrumb. You can copy this syntax directly into an application rule or Reporting where clause of a rule.

Load Complete

For each meta key, there is a list of values (blue text) and counts (green text) found in the current drill point. When you click a value to drill down into a subset of the currently selected data, the display is updated and the new drill point is recorded in the breadcrumb. You can specify the sorting and quantification methods for the values list using the option in the toolbar.

Note: Title, values, and counts for non-indexed meta keys are not drillable; the Values and counts are shown in black. Refer to Manage and Apply Default Meta Keys in an Investigation for a detailed description of non-indexed meta keys in Investigation.

                                           
FeatureDescription
Meta KeyThe name of the meta that is listed, for example, Service Type is a meta key.
Number of values rendered vs number of values available to load The number or values rendered is specified by the Render Threads value in the Investigation Preference settings. In the example above, the meta key is Service Type, and 20 of 20+ values are currently displayed. You can display additional values by clicking ...show more.
the Search icon Clicking The search icon on an indexed meta key opens the Search dialog in which you can enter a filter for the current meta key. The search function is not available for non-indexed meta keys, and is based on the actual meta value rather than the alias. Drilling in the Search dialog using aliases is not supported.
NOTE: Check with your administrator to obtain a list of aliases used for a meta key in Investigation. When an alias is used, this search dialog does not provide results. Instead, you must query the meta key using the Right-click query capability or the Query dialog.
Offline Services: xxx.xxx.xxx.xxx:50004 Lists offline services queried by a 10.4 Broker.
Meta Count, for example
(3)
The number of instances found for a particular meta in the session.
Meta Value, for example
other src
The specific name associated with the found meta.
...show moreIf the number of meta values has been limited (for example, 20), clicking this displays additional meta values for the selected meta key.
Loaded in 0.418 secs. Total running time 0.434 secs. (localhost:50005 loaded in 1 secs....Debug stats display load times based on the Show Debug Information setting.

Meta Key Context Menus

The Meta Keys in the Values panel have context menus. Next to each meta label, a drop-down arrow displays the options that can apply to that item. You can use these to change the way the results for the meta key are displayed in the current view. Changes made to meta keys are displayed in the current view during drill points persist until you refresh the page or select a new service in the Navigate view toolbar. Manage and Apply Default Meta Keys in an Investigation refresh reverts the current view of meta keys as defined in the Manage Default Meta Keys dialog (see Manage and Apply Default Meta Keys in an Investigation). If you have never made modifications in the Manage Default Meta Keys dialog, NetWitness Suite restores the default meta keys from the core service.

  • More Results
  • Max Results
  • Hide Results
  • Meta Key Info

Context Lookup Panel

The Navigate view and the Events view have a panel on the right side called the Context Lookup panel. The Context Lookup panel is displayed only if you have installed and configured the Context Hub service. For more information on configuring the Context Hub service, see the Context Hub Configuration Guide.

The Context Lookup panel displays relevant data when an analyst looks up contextual data for a meta value in the Values panel.

After the administrator configures the Context Hub service, you can view the contextual information for the meta values in the Navigate view and the Events view. For more information on configuring the Context Hub service, see the Context Hub Configuration Guide. For information about performing Context Lookup for meta values, see View Additional Context for a Data Point.

The Context Hub service is pre-configured with default meta type and meta key mapping. For information about the mapping of the context hub meta value with investigation meta key, see "Manage Meta Type and Meta Key Mapping" in the Context Hub Configuration Guide

You can view the type of context data that is available for a highlighted meta value by hovering the mouse over a highlighted meta value. An inline indicator shows which type of context data is available for the meta: Endpoint, Incidents, Alerts, or Lists.

Right-clicking a meta value opens a menu with the context lookup option. The following figure illustrates the Context Lookup option when you right-click a meta value.

This menu is an example of the context menu.

For meta keys such as IP, Host and Mac Address, the details of the values that are flagged are collected from Endpoint, Incident, Alerts, and Lists.

For meta keys such as File, File Hash, Domain, User, the details of the values that are flagged are collected from Incidents, Alerts, and Lists.

The data is displayed in the context panel, only if there is any data available .

For more information about the lookup results and contextual information for different data sources, see Context Lookup Panel.

Previous Topic:Malware Analysis View
Next Topic:Query Dialog
You are here
Table of Contents > Investigation Reference Materials > Navigate View

Attachments

    Outcomes