Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Investigate: Use Profiles to Encapsulate Common Areas for Investigation

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Jan 30, 2020
Version 19Show Document
  • View in full screen mode
 

Query profiles offer a quick and easy way to define a meta group, column group, and a limiting query (preQuery) that you can apply in the Navigate view, the Events view, and the Legacy Events view.

Note: Version 11.4 has a new Events view, which was known as the Event Analysis view in prior versions. The Legacy Events view from Versions 11.3 and earlier is still available when your administrator enables the view as described in the System Configuration Guide.

NetWitness Platform has these built-in profiles: RSA Email Analysis, RSA Endpoint Analysis, RSA File Analysis, RSA Threat Analysis, RSA User & Entity Behavior Analysis, and RSA Web Analysis. Each built-in profile specifies a built-in meta group, column group, and sometimes includes a pre-Query appropriate for the type of investigation. Built-in query profiles make it easy for you to query a specific area of interest; for example, selecting the built-in RSA Email Analysis query profile automatically selects the meta keys, meta groups, and meta columns that are most useful for investigating email activity. As you become more familiar with the meta keys, you can create your own custom query profiles.

In a query profile:

  • The meta group defines the meta keys that are queried (see Use Meta Groups to Focus on Relevant Meta Keys).
  • The column group defines which meta keys from the meta group are displayed as columns in the Events list. By default only the first 15 columns in a column group are displayed as a starting point from which you can select additional columns, remove, and rearrange columns (see more about column groups in Use Columns and Column Groups in the Events List.
  • The pre-Query adds a limiting filter at the beginning of the query you are creating.

The built-in profile names begin with the RSA prefix and are grouped under Default Profiles. You cannot edit or delete built-in profiles, but you can copy an existing profile and edit the copy in the Navigate view or the Legacy Events view. In the Navigate or Legacy Events view toolbar, select Profile > Manage Profiles.

Note: Query profiles are available in the Navigate view, the Legacy Events view, and the Events view and shared globally across users. If one user modifies or deletes a query profile it has an effect on what is available to the other users.

You can create your own custom profiles in the Create Query Profile dialog and the Manage Profiles dialog. The Manage Profiles dialog has some options that are not available in the Create Query Profile dialog.

  • From the Manage Profiles dialog (Navigate view and Legacy Events view), you can configure, add, delete, import, and export profiles and profile groups. You can organize your custom query profiles in Profile Groups (Version 11.2 and later). When upgrading to Version 11.4 from an earlier version,only profile groups that contain profiles are imported.
  • From the Query Profiles menu (11.4 Events view), you can select and apply a query profile. Options in the menu allow you to create (Create Query Profile dialog), edit, and delete (Query Profile Details dialog) custom query profiles. In Version 11.4, the Events view does not use meta groups or profile groups defined in other views.

The following figure illustrates the RSA Email Analysis query profile selected in the Navigate view or Legacy Events view. The query profile name is displayed to the right of the Query option. When a query profile is currently active, the label of the Profile menu is replaced with the query profile name.

Profile Name to the right of the Query option

Version 11.2 and later supports organization of query profiles into groups in the Navigate view and the Legacy Events view. The built-in query profiles are in the Default Profiles group, which cannot be edited. Analysts can create new query profile groups, which anyone can use. After creating profiles, you can edit a profile group to add profiles, remove profiles, or move profiles from one group to another. When you create a profile, it is not added to any profile group by default.

The following figure illustrates the Query Profiles menu in the Version 11.4 Events view. This menu lists the same profiles that are available in the Navigate view and the Legacy Events view. You can create, edit, delete, and apply profiles.

an example of the Query Profiles menu

If a query profile created in the Legacy Events view uses the Log View, Detail View, or List View instead of a column group, the same profile in the 11.4 Events view uses the Summary List column group.

View Query Profile Details (Events View)

If you want to know which meta groups, column groups, and limiting queries (called preQueries) define a query profile, you can view the details of the profile.

To review the details:

  1. Go to Investigate > Events and click Query Profiles in the query bar.
    The Query Profiles menu opens with a list of available profiles.
    an example of the Query Profiles menu
  2. Hover over a query profile and click the information icon (the info icon) to see the meta group, column group, and preQuery configured for the profile.
    This figure shows the details for the RSA Email Analysis profile, one of the built-in profiles.
    an example of the Query Profile Details for a built-in profile
  3. Do one of the following:
    1. To close the dialog, click Close.
    2. If you want to apply the profile, click Select Query Profile.
      The dialog closes. The Events list is updated to reflect the selected query profile. If the profile uses a different column group, the query is re-executed with the preQuery and column groups for the selected profile. If only the preQuery is different, existing filters in the query bar are removed and the preQuery filter (for example, this query: service=24,25,109,110,995,143,220,993) is added in the query bar. The first 15 columns in the associated column group are used in the Events list. You can adjust the columns and create additional filters before executing the query.
      the PreQuery in the query bar
    3. If you want to select different columns from the associated column group, click the settings icon above the Events list on the right.
      The Column Selection list is displayed and you can choose up to 40 columns to display (see Use Columns and Column Groups in the Events List.
      the first 15 columns automatically selected for display in the Events list

Apply a Query Profile (Events View)

If you do not see enough results or the right results in the Events view, an applied profile may be limiting results with a PreQuery. If a PreQuery is applied, the PreQuery filters are visible at the beginning of the query bar.

To select a query profile:

  1. In the Events view toolbar, click Query Profiles.
    The Query Profiles menu opens with a list of available profiles.
  2. Use the Down and Up arrow keys or the mouse to highlight a profile.
  3. Click the highlighted profile.
    The query profile settings are applied immediately. The Events list is updated to reflect the selected profile. If the profile uses a different column group the query is re-executed with the preQuery and column groups for the selected profile. If only the preQuery is different, existing filters in the query bar are removed and the preQuery filters are added in the query bar. The the submit query icon button becomes active so that you can resubmit the query with the new preQuery filters. You can add more filters as usual before or after resubmitting the query.

Create or Edit a Custom Query Profile (Events View)

To create or edit a custom query profile:

  1. In the Events view toolbar, click Query Profiles.
    The Query Profiles menu opens with a list of available profiles.
    the Query Profile menu with an editable custom profile
  2. Do one of the following:
    1. To create a new query profile, click + New Query Profile.
    2. To edit an existing query profile, highlight a custom query profile in the menu, and click the edit (the edit icon) icon.
      The Create Query Profile or the Query Profile Details dialog is displayed. This figure shows a new empty profile, which includes the filter from the Query bar as a preQuery.
      Create Query Profile dialog
  3. In the Profile Name field, type a unique profile name that has no more than 80 characters.
  4. Select a column group from the Column Group drop-down list.
  5. In the PreQuery field, check the default preQuery from the query bar and add filters if you wish.
  6. Click Save Query Profile or Update Query Profile.
    The new profile is saved or the edited profile is updated with your changes.
  7. To close the dialog, click Close.

Delete a Custom Query Profile (Events View)

To delete a custom query profile:

  1. In the Events view toolbar, click Query Profiles.
    The Query Profiles menu opens with a list of available profiles.
    the Query Profile menu with an editable custom profile
  2. Highlight a custom query profile that you want to delete in the menu, and click the edit (the edit icon)icon.
    The Query Profile Details dialog is displayed.
    a custom query profile open for editing
  3. Click the delete icon (the delete icon).
    The profile is deleted, with no option to reverse your decision. The profile is no longer available to anyone.

Navigate to the Manage Profiles Dialog (Navigate and Legacy Events Views)

  1. Go to Investigate > Navigate or Legacy Events. (If the Investigate dialog is displayed, select a service and click Navigate.)
  2. In the toolbar, select Profile > Manage Profiles.
    the Manage Profiles option selected
    The Manage Profiles dialog is displayed.

Create, Edit, or Delete a Profile Group (Navigate or Legacy Events View)

You can create a custom profile group to organize different profiles. Once created, the only edit you can make directly to a profile group is to edit the name of the profile group. To add or remove a profile in a group, edit the profile and assign it to a different profile group as described in Create and Edit Profiles (Navigate or Legacy Events View).

Note: If you migrated profile groups from Version 11.3, empty groups were not migrated.

  1. In the Manage Profiles dialog, do one of the following:

    • To select an existing profile group to edit, double-click the profile group.
    • To add a new profile group, click Add icon and select Add New Profile Group.

    Note: If you want to edit one of the built-in profile groups, click the duplicate icon to make an editable copy.

    A folder with a blank field is displayed at the bottom of the Profiles list in the left column.
    the Profile Group Name entry field

  2. To edit or enter the name of the profile group, double-click the Profile Group and type in the entry field. The name must be between 2 and 80 characters.
    The profile group name is applied to a new profile group or to the profile group you edited. The profile group is now available when configuring a profile.
  3. To delete a profile group do one of the following:
    • If you want to delete a profile group but keep the profiles, click the checkbox to select the group, uncheck the profiles in the group, and click delete.
    • If you want to delete a profile group and the profiles that the group contains, click the checkbox to select the group, and leave the profiles that you want to delete checked.
      A dialog asks for confirmation that you want to delete the group. If you left the mark in the checkbox next to the profiles, the group and the profiles in the group are deleted. If you unchecked the profiles, only the profile group is deleted and the profiles are moved out of the group and available to add to another profile group.

Create and Edit Profiles (Navigate or Legacy Events View)

  1. In the Manage Profiles dialog, do one of the following:

    • To select an existing profile to edit, click the checkbox beside the name.
    • To add a new profile in Version 11.2 and later, click Add icon or click the down arrow next to Add icon and select Add New Profile.
    • To create a new profile in versions prior to 11.2, click Add icon.

    Note: If you want to edit one of the built-in profiles, click the duplicate icon to create a copy, and edit the copy.

    The definition of the profile is available to edit in the right panel. This figure illustrates the definition of one of the built-in profiles.
    the properties of an out-of-the-box profile

  2. Edit or enter the profile name by typing in the Name field. The name must be between 2 and 80 characters.
  3. (Optional for Version 11.2 and later) If you want to add the profile to a profile group, select a profile group from the Profile Group drop-down list.
    If you select a profile group, the profile is added to the group when you save the changes. If you do not select a profile group, the profile is not part of a group.
  4. Select a meta group from the Meta Group drop-down list. You can add custom meta groups as described in Use Meta Groups to Focus on Relevant Meta Keys.
  5. Select a column group for the Column Group drop-down list. You can add custom column groups as described in Use Columns and Column Groups in the Events List.
  6. Type queries to filter results in the PreQuery field. PreQuery follows the same syntax as the Query builder. The PreQuery in the figure uses a meta group called service = 24,25,109,110,995,143,220,993.
  7. Click Save to save the profile without using it, or click Save and Apply to save the profile and use it immediately.
    If you click Save and Apply, a confirmation dialog is displayed before applying the selected profile. For Version 11.2 and later, the PreQuery that you entered in the Manage Profiles dialog is displayed in the breadcrumb.
    Profile Pre-Query displayed in the Events view

Delete a Profile (Navigate or Legacy Events View)

  1. In the Manage Profiles dialog, select a profile by clicking the checkbox beside the name.

    Note: You cannot delete any of the built-in profiles.

  2. Click the Delete option.
    A prompt requests confirmation that you want to delete the profile, and the profile is deleted. The option name in the toolbar reverts to Profile to show that no profile is in effect.

Change the Active Profile (Navigate or Legacy Events View)

If you do not see enough results or the right results in the Navigate or Events views, you may have an active profile that is applying a PreQuery. If you do not want to use any profiles, you can click Deactivate Profile in the Profile drop-down menu.

To use a different profile:

  1. In the Navigate or Legacy Events view toolbar, open the Profiles drop-down menu.
  2. Hover over the Profile option to display a drop-down list of available profiles.
  3. Select the profile you want to use.
    The profile settings are applied immediately.

If you want to change the active profile from the Manage Profile dialog:

  1. In the Navigate or Legacy Events view toolbar, select Profiles > Manage Profiles.
    The Manage Profiles dialog is displayed.
  2. Select a profile from the left panel and click Save and Apply.
    A confirmation dialog is displayed.
  3. Click Yes.
    The profile settings are applied immediately.

Import Profiles (Navigate or Legacy Events View)

In the Navigate view and the Legacy Events view, you can upload or import .jsn files that have been downloaded from another service. When profile groups are exported and then imported, the grouping of profiles is maintained.

  1. In the Manage Profiles dialog, click Import in the left panel toolbar.
    The Profile Import dialog is displayed.
  2. Click Browse or the Upload File field to select a file from your computer.
  3. When the file is selected, click Upload.
    The profile is displayed in the left panel.

Download Profiles (Navigate or Legacy Events View)

In the Navigate view and the Legacy Events view, profiles are downloaded as .jsn files.

  1. In the Manage Profiles dialog, select one or more profiles from the left panel.
  2. In the left panel toolbar, click Export.
    The download begins immediately.

You are here
Table of Contents > Refining the Results Set > Use Query Profiles to Encapsulate Common Areas for Investigation

Attachments

    Outcomes