This topic describes the features available in the Investigation > Events view > Event Reconstruction panel.
By default, Security Analytics displays the best reconstruction for the event determined by the event content or the reconstruction that you have selected in the Default Session View setting for Investigation. You can use the options in the Event Reconstruction toolbar to change the reconstruction method, view side-by-side results, export an event, open an email attachment, extract files, and open the event in a new tab.
To access this panel in a new tab, do one of the following:
- In the Events view, select an event to reconstruct and select Actions > View Event> Open in New Tab.
- In the Event Reconstruction toolbar of previewed reconstruction, click Open Event in New Tab in the toolbar.
The Event Reconstruction is displayed in a new tab.
To access this panel in the current tab, do one of the following:
- At the end of the event, select
- Select an event to reconstruct and select Actions > View Event > Preview Inline.
The Event Reconstruction panel opens in a popup window in the same view.
The Event Reconstruction panel has a toolbar at the top with the following options.>
Beneath the toolbar is a list of meta keys and values. Some of the keys offer a drop-down menu with available actions.
The bar at the bottom of the panel offers several options.