Investigate: Use Profiles to Encapsulate Custom Views

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Sep 11, 2018
Version 15Show Document
  • View in full screen mode
 

Using profiles is a quick and easy way to customize which data is displayed in the Navigate view and the Events view. In the Manage Profiles dialog, you can use a profile to specify which meta groups and column groups are displayed by default, to append queries to an investigation, and to import or export profiles.

Note: Profiles are shared across users in the same NetWitness Platform network. If one user modifies or deletes a profile it has an affect on what is available to the other users.

If you have multiple profiles, you can switch between them to quickly change to the selected profile's preferences. If a profile is currently active, the title of the Profile menu is replaced with the profile name.

The following figure illustrates this in the Navigate view. The profile name is displayed to the right of the Query option. This is also true for the Events view.

Profile Name to the right of the Query option

Beginning with Version 11.2, profiles are organized into profile groups. The built-in profiles are in the Default Profiles group, which cannot be edited. Analysts can create new profile groups, which anyone can use. Once created, you can edit a profile group to add profiles, remove profiles, or move profiles from one group to another. When you create a profile, it is not added to any profile group by default. When exporting profiles, information about the profile group is saved, and profiles are imported to the same group from which they were exported.

Navigate to the Manage Profiles Dialog

  1. Go to INVESTIGATE > Events or INVESTIGATE > Navigate. (If the Investigate dialog is displayed, select a service and click Navigate.)
  2. In the toolbar, select Profile > Manage Profiles.
    the Manage Profiles option selected
    The Manage Profiles dialog is displayed.

Create, Edit, or Delete a Profile Group (Version 11.2 and Above)

You can create a custom profile group to organize different profiles. Once created, the only edit you can make directly to a profile group is to edit the name of the profile group. To add or remove a profile in a group, edit the profile and assign it to a different profile group as described in Create and Edit Profiles.

  1. In the Manage Profiles dialog, do one of the following:

    • To select an existing profile group to edit, double-click the profile group.
    • To add a new profile group, click Add icon and select Add New Profile Group.

    Note: If you want to edit one of the built-in profile groups, click the duplicate icon to make an editable copy.

    A folder with a blank field is displayed at the bottom of the Profiles list in the left column.
    the Profile Group Name entry field

  2. To edit or enter the name of the profile group, double-click the Profile Group and type in the entry field. The name must be between 2 and 80 characters.
    The profile group name is applied to a new profile group or to the profile group you edited. The profile group is now available when configuring a profile.
  3. To delete a profile group do one of the following:
    • If you want to delete a profile group but keep the profiles, select the checkbox to select the group, clear the checkboxes for profiles in the group, and click delete.
    • If you want to delete a profile group and the profiles that the group contains, select the checkbox to select the group, and do not clear the checkboxes for the profiles that you want to delete.
      A dialog asks for confirmation that you want to delete the group. If you did not clear the mark in the checkbox next to the profiles, the group and the profiles in the group are deleted. If you cleared the checkboxes for the profiles, only the profile group is deleted and the profiles are moved out of the group and available to add to another profile group.

Create and Edit Profiles

  1. In the Manage Profiles dialog, do one of the following:

    • To select an existing profile to edit, select the checkbox beside the name.
    • To add a new profile in Version 11.2 and above, click Add icon or click the down arrow next to Add icon and select Add New Profile.
    • To create a new profile in versions prior to 11.2, click Add icon.

    Note: If you want to edit one of the built-in profiles, click the duplicate icon to create a copy, and edit the copy.

    The definition of the profile is available to edit in the right panel. This figure illustrates the definition of one of the built-in profiles.
    the properties of an out-of-the-box profile

  2. Edit or enter the profile name by typing in the Name field. The name must be between 2 and 80 characters.
  3. (Optional for Version 11.2 and above) If you want to add the profile to a profile group, select a profile group from the Profile Group drop-down list.
    If you select a profile group, the profile is added to the group when you save the changes. If you do not select a profile group, the profile is not part of a group.
  4. Select a meta group from the Meta Group drop-down list. You can add custom meta groups as described in Manage Meta Groups.
  5. Select a column group for the Column Group drop-down list. You can add custom column groups as described in Manage Column Groups in the Events View.
  6. Type queries to filter results in the PreQuery field. PreQuery follows the same syntax as the Query builder. The PreQuery in the figure uses a meta group called service = 24,25,109,110,995,143,220,993.
  7. Click Save to save the profile without using it, or click Save and Apply to save the profile and use it immediately.
    If you click Save and Apply, a confirmation dialog is displayed before applying the selected profile. For Version 11.2 and above, the PreQuery that you entered in the Manage Profiles dialog is displayed in the breadcrumb.
    Profile Pre-Query displayed in the Events view

Delete a Profile

  1. In the Manage Profiles dialog, select a profile by selecting the checkbox beside the name.

    Note: You cannot delete any of the built-in profiles.

  2. Click the Delete option.
    A prompt requests confirmation that you want to delete the profile, and the profile is deleted. The option name in the toolbar reverts to Profile to show that no profile is in effect.

Change the Active Profile

If you do not see enough results or the right results in the Navigate or Events views, you may have an active profile that is applying a PreQuery. If you do not want to use any profiles, you can click Deactivate Profile in the Profile drop-down menu.

To use a different profile:

  1. In the Navigate or Events view toolbar, open the Profiles drop-down menu.
  2. Hover over the Profile option to display a drop-down list of available profiles.
  3. Select the profile you want to use.
    The profile settings are applied immediately.

If you want to change the active profile from the Manage Profile dialog:

  1. In the Navigate or Events view toolbar, select Profiles > Manage Profiles.
    The Manage Profiles dialog is displayed.
  2. Select a profile from the left panel and click Save and Apply.
    A confirmation dialog is displayed.
  3. Click Yes.
    The profile settings are applied immediately.

Import Profiles

You can upload or import .jsn files that have been downloaded from another service. When profile groups are exported and then imported, the grouping of profiles is maintained.

  1. In the Manage Profiles dialog, click Import in the left panel toolbar.
    The Profile Import dialog is displayed.
  2. Click Browse or the Upload File field to select a file from your computer.
  3. When the file is selected, click Upload.
    The profile is displayed in the left panel.

Download Profiles

Profiles are downloaded as .jsn files.

  1. In the Manage Profiles dialog, select one or more profiles from the left panel.
  2. In the left panel toolbar, click Export.
    The download begins immediately.
You are here
Table of Contents > Querying and Acting on Data in the Navigate and Events Views > Use Profiles to Encapsulate Custom Views

Attachments

    Outcomes