When conducting an investigation in the Navigate view or Events view, analysts can look up additional context information and intelligence for a meta value or data point from various configured sources, such as ESA.
An Analyst with permission Context Lookup can perform Context Lookup from Investigation views. An administrator must configure roles and permissions as described in "Role Permissions" and "Manage Users with Roles and Permissions".in the System Security and User Management Guide.
To perform context lookup, the administrator must:
- Add the Context Hub service in Security Analytics. (The Context Hub service is included in Security Analytics 10.6 and above.)
- Configure data sources for the Context Hub service as described in the Context Hub Configuration Guide.
View Additional Context using Context Lookup
To view the additional context for a data point from the Investigation views:
- While conducting an investigation or examining events in Security Analytics menu, go to the Navigate view.
The Navigate view has the Values panel on the left and the Context Lookup panel on the right as shown below. The Context Lookup panel does not display any data until you perform a Context Lookup. Meta values that have associated context information are highlighted with a gray color background.
- To view the type of context data that is available for a highlighted meta value, hover the mouse over a highlighted meta value.
An inline indicator shows which type of context data is available for the meta: ECAT, Incidents, Alerts, or Lists.
- To view the Context Lookup data from the Values panel, right-click a highlighted meta value and select Context Lookup in the context menu.
The Context Lookup panel displays the lookup results based on the data available on the configured sources.
Context Lookup for Live Connect
For Live Connect, context lookup is supported only for IP meta type (device.ip, ip.src, ip.dst, paddr, ip.addr, alias.ip). The IP addresses that has live connect data can be identified by using the in-line indicator when you hover the mouse over highlighted IP addresses.
To view live connect contextual data:
- In the Security Analytics menu, select Investigation > Navigate or Events.
The Investigate dialog is displayed.
- Select a service and click Navigate.
- Right-click the IP address and select Context Lookup in the context menu.
The Context Lookup panel displays the lookup results.
Alternatively, if you want to highlight only risky IP addresses, from the Settings dialog, select the option Live Connect: Highlight Risky IPs.
From the lookup panel, you can view the contextual data for the IP address. If the IP address is known within the Live Connect community, you can view community related activities and also provide your feedback based on your investigation.
The following table describes the available options for Live Connect Context Lookup panel:
View Results from Context Lookup Panel
In the Context Lookup panel, you can view the lookup results and explore individual data for further investigation. For example, when you click on a particular Incidents value, the incident details are displayed in the Incident Management view.
For a detailed description of the information displayed on the Context Lookup panel, see Investigation - Context Lookup Panel.