Investigate: Manage Default Meta Keys Dialog

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Oct 24, 2017
Version 8Show Document
  • View in full screen mode
 

In the Manage Default Meta Keys dialog, analysts can specify the meta keys to be displayed during navigation for a specific service. This can help you find the desired data more quickly and prevents the loading of meta data that is not of interest. To access this dialog, in the Navigate View toolbar, select Meta > Manage Default Meta Keys.

Workflow

the Investigate workflow, with View Query Results highlighted

What do you want to do?

                                                
User RoleI want to ...Documentation

Threat Hunter

configure default meta keys for a service*

Manage and Apply Default Meta Keys in an Investigation.

Threat Hunter

submit queryBeginning an Investigation of a Service or Collection
Threat Hunterview query results* Conducting an Investigation

Threat Hunter

reconstruct an event

Reconstruct an Event

Threat Hunteranalyze an event Analyze Events in the Event Analysis View
Threat Hunterconduct malware analysisConducting Malware Analysis

Incident Responder

investigate an incident

NetWitness Respond User Guide

*You can perform this task in the current view.

Related Topics

Quick Look

The following figure illustrates the Manage Default Meta Keys dialog, which has a list of meta keys, toolbar, Close button, and Apply button. In the list, you can view, sort, and manage default meta keys. If you click and drag meta keys, you can rearrange their order. The following table describes columns in the list.

This is the Manage Default Meta Keys dialog

                    
ColumnDescription
Meta KeyThis column displays the meta keys available for the service.
ViewThis column displays the type of view assigned to each meta key. By clicking on the view in each row, you can assign the meta key a different default view. There are four views:
  • Auto: Reverts to the default view for meta keys as specified in the service index file.
  • Close: The values of this meta key are closed by default, and can be opened manually.
  • Hidden: These meta keys are hidden by default, and are not shown in Investigation at all.
  • Open: The values of this meta key are displayed by default.
    When you modify the default meta keys for a non-indexed meta key, you cannot set the key to Open. If you change the default view for a group of meta keys to Open and some of the meta keys are non-indexed, the non-indexed meta keys revert to Auto. As a result, the meta key is automatically loaded only if it is indexed, and non-indexed meta keys are Closed until opened manually.

The following table describes the toolbar options and buttons.

                       
FeatureDescription
The Actions drop-down Clicking the Actions menu allows you change the default view of all the meta keys. There are four views:
  • Auto: Reverts to the default view for meta keys as specified in the service index file.
  • Close: The values of this meta key are closed by default.
  • Hidden: The values of this meta key are hidden by default.
  • Open: The values of this meta key are displayed by default.
CloseCloses the dialog. Any unsaved changes are lost.
ApplyApplies the changes, and they become effective immediately.
You are here
Table of Contents > Investigation Reference Materials > Manage Default Meta Keys Dialog

Attachments

    Outcomes