The Navigate view ( INVESTIGATE > Navigate) displays event metadata--the meta keys and meta values-- that were found in captured data for the selected service. The data is filtered and displayed in accordance with the options you set for profile, time range, meta group, and query. You can also drill into the data by clicking meta keys and meta values. The Navigate view is the default entry point to NetWitness Investigate; you can change the default entry point to one of the other views in the Profile preferences.
The figure below depicts the high-level workflow for investigating event metadata.
In the Navigate view, you can:
- View metadata for events in the Values panel.
- Visualize events in a timeline or parallel coordinates chart.
- Save events, go to an event using the event ID, visualize an event, and print an event.
- View additional contextual data for meta keys and values.
- Open a drill point or an event in the Events view or the Event Analysis view.
What do you want to do?
*You can perform this task in the current view.
This figure illustrates the 11.2 Navigate view.
This figure illustrates the 11.3 Navigate view.
The Navigate view consists of these features:
- Pause/reload button and breadcrumb
- Time banner
- Optional debug information.
- Collapsible Visualization panel
- Values panel
- Context Lookup panel
- Context menus
The following figure is an example of the toolbar. The toolbar provides a way to:
- Change the service being investigated.
- Control the range of data displayed: You can select use profiles, set a time range, use meta groups, and create queries to apply to the data.
- Set the quantification method and sorting method for data in the Values panel.
- Perform actions on the results. You can export and print results, open an event for which you have an event ID in the Events view or Event Analysis view, and pass a query to Informer.
- Configure Investigate settings without navigating away from the Investigate views.
Some of the toolbar options are labeled with the default value or the selected value rather than displaying the name of the option. For example, the time range option in the example above is labeled Last 5 Minutes to reflect the currently selected value. These are the toolbar options.
Pause/Reload Button and Breadcrumb
The breadcrumb tracks each query as you drill down through the metadata for the service. The following figure is an example of the breadcrumb.
Each query is listed with a drop-down menu in a pipe separated string. The last point is the current point, also called the tip. The icon in front of the breadcrumb allows you to pause the loading of meta values and to reload meta values. The breadcrumb does not include the service name and appears only if a query is in effect. If too many drill points exist for display, the overflow is shown as double angle brackets, >>, at the end of the breadcrumb. Each drop-down menu in the breadcrumb is the same, with slight variation based on the position of the crumb.
The following table describes the controls and menu options in the breadcrumb.
(Optional) Debug Information
If you have activated the Show Debug Information setting and the service you are navigating is a Broker, NetWitness Platform, displays the debug information beneath the breadcrumb.
The debug information is the where clause from the current query. The only time there is no where clause is when the time range is all data and there are no drill points. If the Broker has at least one aggregate service that is offline, the debug information also lists the offline service.
(attachment exists)&&(tcp.dstport = '80')&&(risk.info exists)$$time='2014-05-04 18:50:00"-"2014-05-09 18:59:59(attachment exists) && (tcp.dstport = '80') && (risk.info exists) && time="2014-05-04 18:50:00"-"2014-05-09 18:50:59"
In addition, the time taken to load is displayed at the end of each meta key in the Values panel.
Just below the breadcrumb and debug information (if present), the time banner shows the time range used to create the chart. The following figure is an example of the time banner.
At the top of the Navigate view is a visualization of the current drill point. You can use this to drill into data from the Visualization panel (see Filter Results in the Navigate View). You can show or hide the visualization, and choose one of thevisualization options: Timeline or Coordinates. The Visualization opens initially to the last saved Visualization.
The timeline is the count of the number of events that occur at a specific instance. The timeline provides event counts so that you can see if the number of events increases drastically at a given point in time. The timeline displays activity for the specified service and time range as a line chart or a bar chart based on your choice in the Options menu. The second figure illustrates a line chart and third figure illustrates a bar chart.
The timeline displays activity for the specified service and time range, as a line chart or a bar chart based on your choice in the Options menu.
Parallel Coordinates Chart
The Parallel Coordinates chart is one of the choices in the Options menu for visualizing the current drill point. With Coordinates selected in the Visualization Options dialog, you can select the meta data to be displayed (see Visualize Metadata as Parallel Coordinates). An easy way to view a useful Parallel Coordinates chart is to choose a profile group as shown in the following figure.
In the Visualization Options dialog for Coordinates, you can select the meta keys to chart.
In the Add Keys to Parallel Coordinates Visualization dialog, you can select the meta keys or meta groups to use as axes the Parallel Coordinates visualization.
The major feature of the Navigate view is the Values panel, which presents meta keys and meta values found in the service being investigated. Procedures for analyzing data in the Values panel are provided in Filter Results in the Navigate View.
The meta keys in the Values panel have drop-down menus, which offer actions that can apply to that meta key. You can use these to change the way the results for the meta key are displayed in the current view. Changes made to meta keys are displayed in the current view and persist until you refresh the page or select a new service in the Navigate view toolbar. See Drill into Data in the Values Panel
Refresh reverts to the current view of meta keys as defined in the Manage Default Meta Keys dialog (see Manage and Apply Default Meta Keys in an Investigation). If you have never made modifications in the Manage Default Meta Keys dialog, NetWitness Platform, a refresh restores the default meta keys from the core service.
|2||The name of the meta key for which values are listed. In Version 11.3 and later, the user friendly name of the meta key is displayed with the index file name of the meta key following in brackets. For example Content Type [content] gives the user friendly name of the content meta key with the index file name in parentheses. For meta groups, the name of the group is given in plain English with the meta group name following in parentheses. This is an example of a meta group name as it would appear in the Values panel: All User Keys [users.all].|
|3 and 4||Clicking on an indexed meta key opens the Search dialog in which you can enter a filter for the current meta key. The search function is not available for non-indexed meta keys, and is based on the actual meta value rather than the alias. Drilling in the Search dialog using aliases is not supported.|
NOTE: Check with your administrator to obtain a list of aliases used for a meta key in Investigation. When an alias is used, this search dialog does not provide results. Instead, you must query the meta key using the Right-click query capability or the Query dialog.
|5||The meta value associated with the found meta key. These are listed in order by meta value name or by the count of events in which the meta value was found, according to your preference.|
The number of events that include the meta value.
The number or values rendered is specified by the Render Threads value in the Investigation Preference settings. In the example above, the meta key is Content Type, and 40 of 40+ values are currently displayed. You can display additional values by clicking ...show more. The number of instances found for a particular meta in the session.
Values Panel Loading Behavior
The default view is for the last 3 hours of collection, using the default meta keys and non-indexed meta keys closed. The meta keys within the meta groups are displayed in the order that NetWitness Platform queries the keys. As the data loads into the Values panel, NetWitness Platform is optimized to show partial results, loading progress, and service status as the data loads.
The loading behavior is determined by several configuration settings. The highest level settings are configured by the administrator for each user. These are:
- The maximum amount of time allowed for this user to run a query (Query Timeout).
- The limit at which NetWitness Platform stops counting the number of meta values in a session (Session Threshold). If a threshold is set for a session, the Navigate view shows that the threshold was reached and the percentage of results loaded. Any session that does not show a percentage is accurate and was processed to completion. If there is a percentage, that reflects how much processing was completed. The percentage displayed is estimated by extrapolating from the value at the time processing finished, considering the amount of work remaining. Larger percentages are generally more accurate because they require less extrapolating
- The limit at which NetWitness Platform stops counting the number of meta values in a session (Session Threshold). If a threshold is set for a session, the Navigate view shows that the threshold was reached and the percentage of query time used to reach the threshold.
When you have launched an investigation of a service, NetWitness Platform displays results in the Values panel.
- NetWitness Platform loads meta keys and meta values in the Values panel. For each meta key load, the stages of load are:
- Waiting to Be Loaded or Closed. If Closed, no data for that key is loaded.
- Loading progress: NetWitness Platform is receiving and displaying progress messages.
- Partial results: NetWitness Platform is receiving values messages and partial results are displayed in the Values panel.
- Load Complete: All results are finished loading.
- As each meta key load is completed, and final values are displayed, the next meta key is started. The number or values rendered for each meta key is specified by the Render Threads value in the Investigation Preference settings. Loading continues until all keys to be loaded have finished.
- If Show Debug Information is active and the service you are navigating is a 10.4 or later Broker, NetWitness Platform displays load time information beneath the values for each meta key and displays additional load details for the aggregated services. NetWitness Platform also displays the debug information beneath the breadcrumb.
Iterative results provide feedback on the status of queries within the interfaces to provide additional context for how long the data load will take and if any service data is missing. For example, if you are querying a Broker that is aggregating from two Concentrators, NetWitness Platform starts displaying the results from the first Concentrator as soon as it is available, even if the second Concentrator is still waiting for results.
Iterative results also include a notification that service data is missing because the service is unreachable.
When partial values from the Core service are returned but not completed, a message at the end of the meta key listing shows the progress of values loaded. For example, Currently looking at 38 ip.src values 71% indicates that loading of values for the meta key is 71% complete.
If the Show Debug Information setting is in effect, a field at the end of the values displays the status for the different systems against which you are querying within NetWitness Platform. For example, when you are querying against a 10.4 broker pulling from multiple concentrators, NetWitness Platform displays the status of the query on each of the Concentrators, which provides insight into the relative speed of data loading from each of the Concentrators. Each service that participated in the query is listed with the total elapsed time for the query.
Each service that participated in the query is listed with the total elasped time for the query. In the example above, two services returned in 3.207 seconds, localhost:50005 took 2 seconds to return the results. In addition, the where clause of the query is displayed below the breadcrumb. You can copy this syntax directly into an application rule or Reporting where clause of a rule.
For each meta key, there is a list of values (blue text) and counts (green text) found in the current drill point. When you click a value to drill down into a subset of the currently selected data, the display is updated and the new drill point is recorded in the breadcrumb. You can specify the sorting and quantification methods for the values list using the option in the toolbar.