Investigate: Manage Profiles Dialog

Document created by RSA Information Design and Development on Sep 18, 2017Last modified by RSA Information Design and Development on Oct 24, 2017
Version 8Show Document
  • View in full screen mode
 

Profiles allow you to set up custom views in the Navigate view and the Events View. At fresh installation, OOTB profiles are available in the Manage Profiles dialog. The OOTB profile groups are prefixed with RSA for identification and can be duplicated but cannot be edited or deleted. In the Manage Profiles dialog, you can configure, add, delete, import, and export profiles.

To access this dialog in the Investigation > Navigate or Events view toolbar, select Profile > Manage Profiles.

Workflow

the Investigate workflow, with View Query Results highlighted

What do you want to do?

                                                
User RoleI want to ...Documentation

Threat Hunter

configure profiles*

Use Investigation Profiles to Encapsulate Custom Views.

Threat Hunter

submit queryBeginning an Investigation of a Service or Collection
Threat Hunterview query results* Conducting an Investigation

Threat Hunter

reconstruct an event

Reconstruct an Event

Threat Hunteranalyze an event Analyze Events in the Event Analysis View
Threat Hunterconduct malware analysisConducting Malware Analysis

Incident Responder

investigate an incident

NetWitness Respond User Guide

*You can perform this task in the current view.

Related Topics

Quick Look

This is an example of the Manage Profiles dialog.

This is the Manage Profiles dialog

The Manage Profiles dialog has two panels. At the bottom of the dialog there is a row of buttons. The following table describes the buttons.

                            
FieldDescription
CloseCloses the dialog.
CancelCancels all changes.
SaveSaves all changes.
Save and ApplySaves and applies all changes immediately.

The Profile panel on the left side of the dialog displays available profiles and allows you to add, delete, import, and export profiles. The following table describes the fields in the Profile panel.

                               
FieldDescription
Add icon Adds a new profile using the Settings panel on the right side of the Manage Profiles dialog.
Delete icon Deletes the selected profile. A confirmation dialog is displayed before the profile is deleted.
Import icon Displays the Profile Import dialog, where you can upload a file.
Export icon Exports the selected profile to your computer.
Profile NameLists all profile names.

The Settings panel on the right side of the dialog offers options to configure profiles. It can only be used when one profile is selected. The following table describes the fields in the Settings panel.

                            
FeatureDescription
Name Displays the name of the profile.
Meta Group Displays a drop-down menu listing available meta groups.
Column Group Displays a drop-down menu listing available column groups. Three groups are available by default:
  • List View
  • Detail View
  • Log View
PreQuery Defines a limiting query for filtering Investigation results. This query is used when the associated profile is activated and the preQuery applies to any queries used in the Investigation Navigate and Events views. This is an example of a preQuery:
'service=80,25,110'.
You are here
Table of Contents > Investigation Reference Materials > Manage Profiles Dialog

Attachments

    Outcomes