Skip navigation
All Places > Products > RSA NetWitness Platform > RSA NetWitness Platform Online Documentation > Documents
Log in to create and rate content, and to follow, bookmark, and share content with other members.

Investigate: Configure the Events View

Document created by RSA Information Design and Development on Mar 27, 2018Last modified by RSA Information Design and Development on Jan 30, 2020
Version 8Show Document
  • View in full screen mode

Note: The information in this topic applies to RSA NetWitness Platform Version 11.1 and later.

Analysts can set preferences that affect the behavior of NetWitness Platform when using the Investigate > Events view. If the Events view is open; these two buttons give access to preferences dialogs: User Profile icon and Open Preferences icon. The User menu (User Profile icon) is focused on global user preferences such as time zone, while the Events preferences menu (Open Preferences icon) is focused on user preferences for behavior in the Events view. The rest of this section describes both sets of preferences.

Set the Default Investigate View

You can select the default view when you open Investigate: Navigate view, Events view, Hosts view, Files view, Entities view, or Malware Analysis view. The default Investigate view is set in the global User Preferences dialog (in the upper right corner of the NetWitness Platform browser window, select User Profile icon).
The global user preferences are described in detail in the NetWitness Platform Getting Started Guide.

Set User Preferences for the Events View

You can set your own preferences relevant to the Events view. The preferences selected persist per user and are available whenever the specific user logs in to the application.

To set default values for working in the Events view:

  1. In the Events view, click Open Preferences icon.
    The Event Preferences dialog is displayed. The 11.3 and 11.4 versions of the dialog have some differences in labeling and available options as shown in the following figures. The first figure is an example of the Version 11.3 dialog, and the second figure shows the dialog for Version 11.4 and later.
    Event Preferences for the Event Analysis view the Event Preferences drop-down menu
  2. In the Default Events View drop-down menu, select the default reconstruction type when you open an event in the Events panel: Text, Packet, or File .
    If you have not selected a default analysis type, when you open an event, the default reconstruction type is the Packet analysis, except for log and endpoint events, which open to the Text analysis. If you select a default reconstruction type, the reconstruction type is the default reconstruction that you specified. In both cases, the default is the starting point, and if you change the type while you are working, the type you choose is used for the next reconstruction.
  3. In the Default Log Format drop-down, select the download format for exporting logs: Download Log (11.3) or Download Text (11.4), Download XML, Download CSV, or Download JSON. If you do not select a format here, the default download format is Download Text. These options are also available at the time of download in a drop-down menu.
  4. In the Default Packet Format (11.3) or Default Network Format (11.4) drop-down menu, select the default format for downloading packets. These options are also available at the time of download in a drop-down menu:
    • Download PCAP to download the entire event as a packet capture (*.pcap) file
    • Download All Payloads (11.3) or Download Payloads (11.4) to download the payload as a *.payload file
    • Download Request Payload to download the request payload as a *.payload1 file
    • Download Response Payload to download the response payload as a *.payload2 file
  5. (Version 11.4 and later) In the Default Meta Format drop-down menu, select the download format for exporting metadata: Download Text, Download CSV, Download TSV, or Download JSON. If you do not select a format here, the default download format is Download Text.
  6. Under Time Format for Query, choose either Database Time or Current Time (11.4). The Events view can display results based on the database time or the current clock time. When you set the time format, your individual user preference is saved until changed again. The default setting for this preference is Database Time, which is the same time format used to display query results in the Navigate view and Legacy Events view.
    • When Database Time is selected, the start and end time for a query is based on the time that the event was stored.
    • When Current Time (labeled Wall Clock Time in Version 11.3 and earlier) is selected, the query is executed with the current time in accordance with the timezone set in user preferences. The current time is focused on real time ingestion of captured data rather than PCAP uploads.
  7. (Version 11.4 and later) To set the sort sequence by collection time for the events listed in the Events panel, select one option under Default Event Sort Order:

    • Ascending (default): To put the events with the earliest collection time first in the list.
    • Descending: To put the events with the latest collection time first in the list. When investigating logs, you may want to change the sort sequence to see the latest collection time first.

    If results exceed the events limit, not all events can be loaded. The portion of returned events loaded in the Events panel matches the sort order preference: the oldest portion of events is loaded when Ascending order is selected, and newest portion of events is loaded when Descending order is selected.

  8. If you want all extracted files to be downloaded automatically, select the Download extracted files automatically checkbox. You can go to the Jobs queue to view the extracted files.
  9. (Version 11.3 and later) To automatically update the time range window in the query bar when the service is polled (at one minute intervals) and sends fresh results, select the Update Time Window Automatically checkbox. When the time range is updated, the the submit query button (Submit Query) button is activated and you can click to get the fresh results. To keep the time range window in the query bar synchronized with the current results, clear the checkbox (this is the default value).

You are here
Table of Contents > Configuring NetWitness Investigate Views and Preferences > Configure the Events View