Investigate: Manage Meta Groups Dialog

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Apr 25, 2019
Version 17Show Document
  • View in full screen mode
 

In the Investigate > Navigate view, you can use meta groups to filter data displayed in an investigation. A fresh installation of NetWitness Platform includes out-of-the-box (OOTB) meta groups to help you find interesting data sets in Investigate. The OOTB meta groups are prefixed with RSA for identification and can be duplicated but cannot be edited or deleted. You can create your own groups and you can duplicate and edit an OOTB group to create a custom group. With a meta group in effect during an investigation, the information in the Values panel shows only the meta keys in the selected group. In the Manage Meta Groups dialog, you can add, delete, import, and export meta groups (see Manage and Apply Default Meta Keys in an Investigation).

To access this dialog in the INVESTIGATE > Navigate view toolbar, select Meta > Manage Meta Groups

Related Topics

Quick Look

The following figure is an example of the Manage Meta Groups dialog.

Manage Meta Groups dialog showing Version 11.2 meta groups

The Meta Groups panel is on the left side of the Manage Meta Groups dialog. This is where you can add, delete, import, and export meta groups. The following table describes the features of the Meta Groups panel.

                                   
FeatureDescription
Add icon Adds a meta group using the Settings panel on the right side of the Manage Meta Groups dialog.
Delete icon Deletes the selected meta group. A confirmation dialog is displayed before the meta group is deleted.

the Duplicate icon

Creates a copy of the selected meta group.

Import icon Displays the Meta Group Import dialog, where you can upload a file.
Export icon Exports the selected meta group to your computer.
Group NameLists all meta group names.

The Settings panel is on the right side of the Manage Meta Groups dialog. This is where you create and edit meta groups. Below the Name field is the Meta Keys list. The following table describes the features of the Settings panel.

                                        
FeatureDescription
NameDisplays the name of the selected meta group.
Add icon Displays the Available Meta Keys dialog, where you can select meta keys to add to the group.
Delete icon Deletes the selected meta keys.
Actions drop-down Displays a drop-down menu, where you can select the view for all meta keys. There are four options based on the possible values for the defaultAction property used to define a key in the custom index file for the service:
  • Hidden: These meta keys are hidden by default, and are not shown in Investigation at all.
  • Open: The values of this meta key are displayed by default.
  • Close: The values of this meta key are closed by default, and can be opened manually.
  • Auto: Reverts to the default view for meta keys as specified in the service index file.
Display NameIndicates the name that is displayed for the key in Investigate views, and is defined by the description property for the key in the custom index file for the service..
Key NameIndicates the name of the meta key as defined in the custom index file for the service.
View Indicates the view to which the meta key is set. You can change:
  • Change the view for all meta keys by clicking Actions drop-down in the View column header, then selecting a view from the drop-down menu.
  • Change the view for a single meta key by clicking a single meta key in the View column, then Actions drop-down and selecting a view from the drop-down menu.

The following table describes the buttons at the bottom of the dialog.

                            
FeatureDescription
CloseCloses the dialog.
CancelCancels all changes.
SaveSaves all changes.
Save and ApplySaves and immediately applies all changes.

You are here
Table of Contents > Investigate Reference Materials > Manage Meta Groups Dialog

Attachments

    Outcomes