Investigate: Open an Event in the Events List

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Sep 11, 2018
Version 15Show Document
  • View in full screen mode
 

Analysts can view a list of events associated with a session in the Investigate > Events view or in the Event Analysis view.

To display events in the Events view do one of the following:

  1. To use the default query for the default service, go to INVESTIGATE > Events.
    NetWitness Platform runs a default query on the last three hours for the default service (if one is set) or displays a dialog in which you can select a service and then runs the default query. The default query selects all events and the Events view displays events on the selected service, with the oldest events first. 
  2. To view events for a specific meta value, go to INVESTIGATE > Navigate and when events are loaded in the Values panel, click a meta count (the meta count is in green text). You can also right-click the meta count for a meta value . When the context menu is displayed, click Open Events in new tab. (The Open Event Analysis in new tab option is available in Verison 11.1 and later.)
    Open Event Analysis in new tab option and Open Events in new tab option
    The Events view displays the events for the selected meta value. 

The Events view provides three built-in presentations of event data: the Detail view, the List view, and the Log view.

This figure is an example of the Detail view.

the Detail view
You can use queries, the time range setting, and profiles to filter the events listed in the Events view. From any view type in Events view, you can extract files, export events, export logs, and open the Event Reconstruction panel by double-clicking an event. See Examining Raw Events in the Events View for detailed information about these capabilities.

To display events in the Event Analysis view, do one of the following:

  1. In Version 11.0 and later, go to INVESTIGATE > Navigate, right-click the meta count for a meta value (the meta count is in green text). When the context menu is displayed, select Open Event Analysis in new tab.
    Open Event Analysis in new tab option and Open Events in new tab option
    The Event Analysis view displays the events for the selected meta value. 
    Events in the Event Analysis view

For detailed information about the types of analysis that you can use in this view, see Analyzing Raw Events and Metadata in the Event Analysis View .

You are here
Table of Contents > Investigating Metadata in the Navigate View > Open an Event in the Events List

Attachments

    Outcomes