on Sep 18, 2017After an administrator configures the Context Hub service, you can view the contextual information for the meta values in the Navigate view, Legacy Events view, and Events view (Version 11.2 and later). The Context Hub service is pre-configured with a default meta type and meta key mapping. For information about mapping of the context hub meta value with investigation meta key, see "Manage Meta Type and Meta Key Mapping" in the Context Hub Configuration Guide.
The Context Lookup panel is displayed on the right side of the Navigate view, Legacy Events view, or Events view. Meta values that have been added to a Context Hub list are highlighted in gray in the Navigate view or Legacy Events view results. In the Events view, they are marked by an underscore. When you right-click a highlighted value and select Context Lookup in the resulting context menu, the lookup results are displayed in the Context Lookup panel for configured sources for the selected meta value. You can select a source in the Context Lookup panel icon bar to view the contextual information.
There are some differences between the appearance and contents of the Context Lookup panel when open in the Navigate view or Events view and when open in the Events view.
Workflow
What do you want to do?
| User Role | I want to ... | Show me how |
|---|---|---|
| Incident Responder or Threat Hunter | review detections and signals seen in my environment | NetWitness Platform Getting Started Guide |
| Incident Responder | review critical incidents or alerts | NetWitness Respond User Guide |
| Threat Hunter | query a service, metadata, and time range | Begin an Investigation in the Events View Begin an Investigation in the Navigate or Legacy Events View |
| Threat Hunter | view metadata | |
| Threat Hunter | view sequential events | |
| Threat Hunter | reconstruct and analyze an event | |
| Threat Hunter | examine files and associated hosts | Download Data in the Events View |
| Threat Hunter | perform lookups* | |
| Threat Hunter | create an incident or add to an incident | |
| Threat Hunter | add a meta value to a Context Hub list |
*You can perform this task in the current view.
Related Topics
- How NetWitness Investigate Works
- Legacy Events View
- Navigate View
- Events View
- "NetWitness Feedback and Data Sharing" in the Live Services Management Guide
Quick Look (in the Navigate and Legacy Events Views)
The following figure is an example of the Context Lookup panel as it appears in the Navigate view. Controls and features are described in the table.
| Feature | Description |
|---|---|
| Source Options Bar | Displays the icons for the available sources: Endpoint, Incidents, Alerts, and Lists. |
| Source Name | Displays the source name based on the selected icon:
|
| Sort | Provides a drop-down of sort options for the listed context information. Possible sort options are Severity - High to Low, Severity Low to High, Date - Oldest to Newest. and Date - Newest to Oldest. The sorting options vary by source type. |
 | Refreshes the lookup results. |
| <n items> (First <n> Results) | The footer provides a count of results currently displayed and the total number of results. For example, 5 Alerts (First 50 Results). |
Incidents
Incidents are displayed based on time first (Newest to Oldest) and then priority status. The following information is displayed for incident lookups:
- Incident Name and ID
- Priority status of the incidents
- Risk Score value of the incidents
- Date when the incident was created
- Status of the incident
- Assignee for the incident
- Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
- Time window: This is based on the value that is set for the "Query Last (Days)" field in the Configure Respond window. For details, see the "Configure Respond as a Data Source" topic in the Context Hub Configuration Guide.
- Sort: This drop-down field provides options to change the sorting of result based on time or priority.
Alerts
Alerts are displayed based on the Severity. ;The following information is displayed for alert lookups:
- Alert Name
- Severity value of the alerts
- Date when the alert was created
- Incident ID: This is the ID of the incident that the alert is associated with (If any).
- Sources: Event source name
- Number of events associated with the alert.
- Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
- Time window: This is based on the value that is set for the "Query Last (Days)" field in the Configure Respond window. For details, see the "Configure Respond as a Data Source" topic in the Context Hub Configuration Guide
- Sort: This drop-down field provides option to change the sorting of result based on time or priority.
Lists
The following information is displayed for list lookups.
- List Name
- Owner who created the list
- Created Date
- Last Updated Date
- Description of the list
Endpoint
The following information is displayed for Endpoint lookups.
- Machine name and IP address of the machine.
By clicking on the IP or Endpoint machine name, you will be navigated to Endpoint UI to perform further investigation. - Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
- Machine Score: A machine IIOC score is aggregated based on the module scores.
- Number of modules: Number of active files for the selected machine.
- Last Updated: Indicates when the scan results were last updated in Endpoint database.
- Last Login User
- Machine MAC Address
- Operating System Version
- Admin Notes (if any)
- Admin Status (if any)
- Top Suspicious Modules (Modules that have an IIOC score > 500). This is based on the value set for "Minimum IIOC Score" field in the Configure Endpoint window. The default value for "Minimum IIOC Score" is 500.
- Machine IIOC Levels
Quick Look in the Events View (Version 11.2 and Later)
The following figure is an example of the Context Lookup panel as it appears in the Events view.
The contextual information or query results displayed in the Context Lookup panel depends on the selected entity and the associated data sources. The Context Lookup panel has separate tabs for each of the data sources. The tabs are: List data source, Archer, Active Directory, Endpoint, Incidents, Alerts, and Live Connect. The following figure shows the Context Lookup panel for a selected entity in the Incident Details view.
The following table describes the data available on each tab and the supported entities.
| Tab | Description | Supported Entities |
|---|---|---|
| | Displays all of the list data associated with the selected entity or meta value. The result is sorted by the last updated list. | All entities |
| (Archer) | Displays asset information along with criticality ratings using the Archer data source. | IP, Host, and Mac |
| | Displays all user information for the selected user. | User |
| | Displays the NetWitness Endpoint data source information for the selected entity or meta value, which includes the Machines, Modules, and IIOC levels. Modules are by highest IOC score to lowest IIOC score and IIOC levels are sorted by highest IOC levels to lowest IOC levels. | IP, MAC address, and Host |
| (Incidents) | Displays the list of incidents associated with the selected entity or meta value. The result is sorted by newest incidents to oldest incidents. | All entities |
| (Alerts) | Displays the list of alerts associated with the selected entity or meta value. The result is sorted by newest alerts to oldest alerts. | All entities |
| (Live Connect) | Displays information related to Live Connect. | IP, Domain, and Filehash |
| (File Reputation) | Displays file reputation status for Filehash entities. | Filehash entities |
|
TI | Displays information for STIX data sources. | IP address, email address, domain, filename, URL's, and file hash. Note: The context lookup for email address and URL will be displayed only if these metas are mapped. Navigate to |
Lists Tab
The Context Lookup panel for Lists shows one or more lists associated with the selected entity or meta value. The following figure is an example of the Context Panel for Lists, and the table describes the fields.
| Field | Description |
|---|---|
| Name | The name of the list (defined while creating the list). |
| Description | The description of the list (defined while creating the list). |
| Author | The owner who created the list. |
| Created | The date when the list was created. |
| Updated | The date when the list was last updated or modifed. |
| Count | The number of lists in which the selected entity or meta value is available. |
| Time Window | The time window based on the value set for the "Query Last" field in the Configure Responses dialog. By default, all Lists data is fetched. |
| Last Updated | The time when Context Hub fetched and stored the lookup data in cache. |
Archer Tab
The Context Lookup panel for Archer displays asset information along with criticality ratings using the Archer data source for IP, Host, and Mac entities. The following figure is an example of the Context Lookup panel for Archer, and the table describes each field.
| Field | Description |
|---|---|
| Criticality Rating | The device operational criticality based on the applications it supports. The criticality ratings can be set as Not Rated, Low, Medium-Low, Medium, Medium-High, or High. |
| Risk Rating | The calculated risk rating for the device based on the most recent assessment and the average risk rating of facilities using the device. The risk rating can be set as Severe, High, Medium, Low, or Minimal. |
| Device Name | The unique name of the device. |
| Host Name | The host name of the device. |
| IP Address | The primary internal IP address of the device. |
| Device ID | The automatically populated value that uniquely identifies the record across all applications within the system. |
| Type | The device type, for example, server, laptop, desktop, and others. |
| Facilities | Links to records in the Facilities application that are related to this device. |
| Business Unit | Links to records in the Business Unit application that are related to this device. For more than three business unit values, you can hover over the field to view the values. |
| Device Owner | The person who is responsible for the device and receives read and update rights of the record. |
| Count | The number of assets available. |
| Time Window | The time window based on the value that is set for the "Query Last" field in the Configure Responses dialog. By default, all data for Archer is fetched. |
| Last Updated | The time when Context Hub fetched and stored the lookup data in cache. |
Note: In the localized versions, only these twelve fields are displayed: Criticality Rating, Risk Rating, Device Owner, Business Unit, Host Name, MAC Address, Facilities, IP Address, Type, Device ID, Device Name, and Business Processes.
Active Directory Tab
The following figure is an example of a Context Lookup panel for Active Directory.
The Context Lookup panel for Active Directory displays all the related information, incidents, and alerts for a user. You can perform a look up using the following formats:
- userPrincipalName
- Domain\UserName
- sAMAccountName
The following information is displayed for Active Directory.
| Field | Description |
|---|---|
| Display Name | The name of the user. |
| Employee ID | The employee ID of the user. |
| Phone | The phone number of the user. |
| | The email ID of the user. |
| AD User ID | The unique identification of the user within an organization. |
| Job Title | The designation of the user. |
| Manager | The name of the user's manager. |
| Groups | The list of groups of which the user is a member. |
| Company | The name of the user's company. |
| Department | The department name to which the user belongs within the organization. |
| Location | The location of the user. |
| Last Logon | The time when the user logged into the system, only if the Global Catalogue is defined. |
| Last Logon TimeStamp | The time when the user logged into the system. |
| Distinguished Name | The unique name assigned to the user. |
| Count | The number of users. |
| Time Window | The time window based on the value that is set for the "Query Last" field in the Configure Data Source Settings dialog. By default, all data for Active Directory is fetched. |
| Last Updated | The time when Context Hub fetched and stored the lookup data in cache. |
NetWitness Endpoint Tab
The following figure is an example of the Context Lookup panel for NetWitness Endpoint.
The following information displayed for IIOCs.
| Field | Description |
|---|---|
| # Of Modules | The number modules that are looked up. |
| Admin Status | The admin status (if any). |
| Last Updated | The time when the data was last refreshed. |
| Last Login | The time when the user last logged in. |
| MAC Address | The Machine MAC Address. |
| Operating System | The Version of the Operating System used by the NetWitness Endpoint machine. |
| Machine Status | The state of the module being viewed: Online, Offline, Active, or Inactive. |
| IP Address | The IP address of the specific module. |
The following information is displayed for modules.
| Field | Description |
|---|---|
| IIOC Score | A machine IIOC score is an aggregated score based on the module scores. This is based on the value set for Minimum IIOC Score field in the Context Hub Data Source Settings dialog. The default value for Minimum IIOC Score is 500. See "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide. |
| Module Name | The name of the module that is being looked up. |
| Analytic Score | The number of active files for the selected machine. |
| Machine Count | The number of machines on which that particular IOC got triggered. |
| Signature | Indicator of whether the file is signed or unsigned, valid or invalid, and signatory information. For example, Google, Apple, and so on. |
The following information is displayed for machines.
| Field | Description |
|---|---|
| IOC Levels | The IOC levels. |
| Description | The description for he IOC level if available. |
| Last executed | The time when the action was executed. |
| Count | The number of hosts that are being looked up. |
| Time Window | The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, all data for NetWitness Endpoint is fetched. |
| Last Updated | The time when scan results were last updated in NetWitness Endpoint database. |
Alerts Tab
The following figure is an example of Context Panel for Alerts that is displayed based on time first (Newest to Oldest) and then severity.
The following information is displayed in the Context Lookup panel for Alerts.
| Field | Description |
|---|---|
| Created | The date and time when the alert was created. |
| Severity | The severity value of the alerts. |
| Name | The name of the alert. You can click the name to view the details of a specific alert. |
| Source | The alert source name from which the alert is triggered. |
| #Events | The number of events associated with the alert. |
| Incident ID | The ID of the incident (if any) with which the alert is associated. You can click the ID to view the details of a specific alert. |
| Count | The number of alerts. By default only the first 100 alerts are displayed. For more information on how to configure the settings, see "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide. |
| Time Window | The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, the alert data for last 7 days is fetched. |
| Last Updated | The time when contextual data was last fetched from data source. |
Incidents Tab
The following figure is an example of the Context Panel for Incidents, which is based on time first (Newest to Oldest) and then priority status.
The following information is displayed in the Context Lookup panel for Incidents.
| Field | Description |
|---|---|
| Created | The date when the incident was created. |
| Priority | The priority status of the incidents. |
| Risk Score | The risk score of the incidents. |
| ID | The Incident ID of the incident. You can click on the ID to display further details about the incident. |
| Name | The incident name. |
| Status | The status of the incident |
| Assignee | The current owner of the incident. |
| Alerts | The number of alerts associated with the incident. |
| Count | The number of incidents. By default only the first 100 incidents are displayed. For more information on how configure the settings, see "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide. |
| Time Window | The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, the alert data for last 7 days is fetched. |
| Last Updated | The time when contextual data was last fetched from data source. |
Live Connect Tab
The following figure is an example of a Context Panel for Live Connect, and the table describes the information displayed.
| Field | Description |
|---|---|
| Review Status | The review status of the selected Live Connect entity (IP, file, or domain) based on the analyst activity. This gives the visibility of the analyst activity within an organization. Status
|
| Risk Assessment | The risk assessment for the selected Live Connect entity (IP, file, or domain) based on the Live Connect analysis and analyst feedback. The Risk Assessment categories are:
|
| Risk Assessment Feedback |
Risk Assessment Feedback allows the analyst to submit threat intelligence feedback about an entity to the Live Connect server.
|
| Community Activity | Community activities such as:
Trending Community Activity: If the IP address is known within the RSA community, a graphical representation of the community activity trend is displayed for the following:
|
| Risk Indicators |
Risk indicators are highlighted based on the tags that are assigned by the community to the entities (IPs, Files, or Domains). The tags are categorized as follows: Reconnaissance, Delivery, Command and Control, Lateral Movement, Privilege Escalation, and Packaging and Exfiltration. These tags are samples and vary based on the inputs received from the community on the Live Connect server. The analyst can choose the appropriate risk indicator tags while providing the review feedback. A highlighted tag indicates that the selected entity is associated with that particular category and tag. Clicking a highlighted tag displays the description of the tag. |
| Identity | Provides the following identity information for the selected entity or meta value: For IP address: Autonomous System Number (ASN), Prefix, Country Code and Country Name, Registrant (Organization), and Date. For File Hash: File Name, File Size, MD5, SH1, SH256, Compile Time, and Mime Type. For Domain: Domain Name and Associated IP Address. |
| Certificate Information | Provides the following certificate information for the selected file hash: Certificate Issuer, Validity of the Certificate, Signature Algorithm, and Certificate Serial Number. |
| WHO IS Information |
The WHO IS information provides the ownership details for a given domain. The following information about the domain owner is displayed: Created Date, Updated Date, Expired Date, Type (Registration Type), Name, Organization, Address with Postal code, Country, Phone, Fax, and Email. |
| Related Files | Related Files are displayed for entity types IP and Domain. A list of known associated files is displayed along with the following information: Live Connect Risk Rating (Safe, Risky, or Unknown), File Name, MD5, Compile Time and Date, API Function, Import Hash, and Mime Type. |
| Related Domains | Related Domains are displayed for entity types IP and Files. A list of known associated domains is displayed along with the following information: Live Connect Risk Rating (Safe, Risky, or Unknown), Domain Name, Country Name, Registered Date, Expired Date, and Registrant Email address. |
| Related IPs |
Related IPs are displayed for entity types Domain and Files. A list of known associated IPs is displayed along with the following information: Live Connect Risk Rating (Safe, Risky, or Unknown), IP Address, Domain Name, Country Code and Country Name, Country Name, Registered Date, Expired Date, and Registrant Email address. |
File Reputation Tab
The Context Lookup panel for File Reputation displays the file reputation status of a file.
| Field | Description |
|---|---|
| Reputation Status | Reputation Status of filehash. For more information about reputation status, see "View Reputation of files" in the UEBA User Guide. |
| Scanner Match | Number of scanners that detected malware or suspicious activity in the last scan. |
| Classification Platform | Classification for the queried filehash based on the platform. For example, the platform can be Win 32. |
| Classification Type | Classification for the queried filehash based on the type. |
| Classification Family | Classification for the queried filehash based on the malware family name. |
TI Tab
The following figure is an example of a Context Panel for TI, and the table describes the information displayed.
| Field | Description |
|---|---|
| Data Source name | Displays the STIX data source name from where the data is retrieved. |
| Timestamp | The time when the event was created. |
| Indicator Details | Indicator Title: Displays the details that contains a pattern that can be used to detect suspicious or malicious cyber activity. ID: Displays the ID of the selected indicator. Produced by: Displays the user role who requested for the STIX data. |
| Observable | Observable Title: Displays and conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs). ID: Displays the ID of the selected observable. |
| (Optional) Sightings | Sightings Title: Displays the name of the sighting source. Confidence: Displays the criticality of the sighting. Reference: Displays the reference URL of the sighting source. |
