Investigate: Filter Results in the Event Analysis View

Document created by RSA Information Design and Development on Mar 27, 2018Last modified by RSA Information Design and Development on Apr 3, 2018
Version 2Show Document
  • View in full screen mode
 

Note: The information in this topic applies to RSA NetWitness® Suite Version 11.1 and later.

In NetWitness SuiteVersion 11.0, you submit a query in the Navigate view or the Events view, and when you go to the Event Analysis view, a read-only breadcrumb shows the submitted query. You need to go to back to the Events view or Navigate view if you want to enter a different query.

In Version 11.1 and later, a query builder populates the interactive breadcrumb in the Event Analysis view so that you can create and edit each <meta key> <operator> <meta value> filter in the breadcrumb. In addition, you can select a different service and time range without going back to the Navigate view or the Events view. The remainder of this section provides information about using the Version 11.1 query builder features.

How the Breadcrumb Works

When you click the Event Analysis option in Investigate to open the view, the service and time range selector is displayed. By default, the first service is auto selected (unless you previously selected a service and the selected service is in localstorage). If you do not select a time range, the default time range is used. The query builder field is an empty field to the right of the time range. The following figure illustrates the breadcrumb with only a service and time range selected.

example of the Event Analysis breadcrumb

When you open the Event Analysis view from the Events view or the Navigate view, the service, time range, and any filters that were selected in the Events view or Navigate view are displayed in the breadcrumb. The service, time range, and individual filters can be modified.

Note: The query builder supports only simple filters in the form <meta key><operator><meta value>. If the Events view or Navigate view has a filter with more than one operator, ||,&&, (), REGEX, or LENGTH, the filter is added, but editing is not supported in the Event Analysis view.

As you create filters in the query builder, the breadcrumb is updated with each filter in an editable field. When you submit the query, all of the filters are AND'd to generate results. The query is not submitted until you click Query Events. Filters line up from left to right, representing the sequence in which the filters were created. Each filter is a simple expression of the form <meta key> <operator> <optional value>. As more filters are added and they cannot be displayed in a single line, they wrap to another line and the input area expands vertically so that all filters are visible without scrolling to the right.

As you create and edit filters, you are assisted with suggestions for auto-complete that show only valid meta keys and operators in the drop-down list. You can type or select from the drop-down list. Invalid filters are marked by a red outline, and if you hover the mouse over the filter, a message that explains the error is displayed.

The Query Events button is on the right side of the breadcrumb input, and is visible as needed to input a query. New filters are applied when you click Query Events.

Note: If you change the service, a network call for data for reconstructions or the Events panel (for example, Load More) uses the previous service/time range/metadata filters. It will continue to use these previous query parameters until you submit the new query. When you have a set of results loaded and you change the service, time range, or a filter, the Query Events button turns blue as an indicator that the data in the view is stale. Even if you start to edit any one of the parameters, and then decide not to, the Query Events button turns blue as an indicator that you need to resubmit the query.

The following figure illustrates a breadcrumb with a filter.

Breadcrumb with a filter added

Keyboard Actions to Use in the Breadcrumb

The breadcrumb is designed to allow entry, editing, and deletion of filters from the keyboard without having to use a pointer. Although you can use the pointer, you have the option to keep your fingers on the keyboard. This table identifies the available keyboard actions when the cursor is located in the Query Builder portion of the breadcrumb; these do not apply to the service selector and time range.

                                                               
ActionKeyboard Entry
Update the URL and resubmit the query.With focus on the Query Builder, press Enter.
Select the filter to the immediate left if one exists.With no selection in the Query Builder, press the Left Arrow key.
Select the filter to the immediate right if one exists.With no selection in the Query Builder, press the Right Arrow key
Insert a new filter to the immediate left of the selected filter.With a filter selected, press the Left Arrow key
Insert a new filter to the immediate right of the selected filter.With a filter selected, press theRight Arrow key.
Insert a new filter to the immediate left of the selected filter, and open for editing.With a filter selected, press the Shift + Left Arrow keys.
Insert a new filter to the immediate left of the selected filter, and open for editing.With a filter selected, press the Shift + Right Arrow keys.
Select all filters to the right of the current filter.With a filter selected, press the Shift + Down Arrow keys.

Select all filters to the left of the current filter.

With a filter selected, press the Shift + Up Arrow keys.

Deselect all filters.With a filter selected, press the Escape key.

Delete all selected filters.

With filters selected, choose the right-click > Delete selected filters option, press Delete, or press Backspace.

Update query with only the selected filters.With filters selected, choose the right-click > query with selected filters option.

Open a new tab with the selected filters.

With filters selected, choose the right-click > query with selected filters in a new tab option.

Add a Filter to the Breadcrumb

To filter the data displayed in the Event Analysis view:

  1. Navigate to the Event Analysis view.
  2. To insert a filter, click in the query builder field, or before or after an existing filter.
    If the insertion point is between two filters, a green dot marks the insertion point. If the insertion point is at the end of the existing breadcrumb, the filter entry field opens.
    Green dot marks the insertion point

  3. Click on the insertion point and a drop-down menu lists available meta keys to use in the new filter. The available meta keys are passed from the service being investigated.
    drop-down list of meta keys at the insertion point

  4. To select a meta key do one of the following:

    1. If there is only one option in the drop-down menu, press the Space bar.
    2. If there are two or more options in the drop-down menu, click on the meta key or use the up/down arrow and press Enter.
    3. Type the meta key and a space. As you type the meta key, the list is further updated.
      With a meta key selected, a list of valid operators for the selected meta key is displayed.
  5. To select an operator do one of the following:

    1. If there is only one option in the drop-down menu, press the Space bar.
    2. If there are two or more options in the drop-down menu, click on the operator or use the up/down arrow and press Return.
    3. Type the operator and press Enter.
      The drop-down list closes and you can add a value if the operator accepts a value.
  6. (Optional) Type a value and press Enter.

  7. To create the filter, press Enter. If you click anywhere outside the box before pressing Enter, the filter is not created.
    The new filter is inserted, and the cursor is refocused after the last filter.
    If there is an error in the filter, it is outlined in red. You can hover over the filter to see a tool tip explaining the error.
    filters added
  8. Fix any filters that have errors.
  9. When you are ready to execute the query in the breadcrumb, click Query Events.
  10. The Events List is refreshed to reflect the query.

Edit a Filter in the Breadcrumb

To edit a filter in the Query Builder:

  1. Navigate to the Event Analysis view.
  2. To edit a filter, double-click it, or click the filter and press Enter.
  3. When finished editing, press Enter to update the filter.
  4. To deselect the filter, click another filter.
  5. If you want to execute the query again, click the Query button.
    The Events List is refreshed to reflect the updated filter.

Query Using Selected Filters in the Breadcrumb

With two or more filters in the breadcrumb, you can refocus the same query to include only selected filters. The results are displayed in the current browser tab or a new browser tab.

To update the query using only selected filters:

  1. Begin with a breadcrumb that includes at least two filters, for example a query has three filters: risk.info = exists, direction ="lateral", and threat.category exists.
  2. To open a new tab with the selected filters, right-click the query direction = "lateral" filter and select query with selected filters in a new tab in the drop-down menu.
    the Query with selected filters in a new tab option selected
    A new tab opens with the results for the selected filter.
    results in a new tab
  3. To query the selected filters in the same tab, click direction = "lateral" and threat.category exists. Then right-click and select query with selected filters in the drop-down menu.
    the Query with selected filters option selected in the drop-down menu

Delete a Filter in the Breadcrumb

To delete a filter:

  1. Click X in a filter, click on the filter to select it and press Delete , or right-click one or more filters and select Delete selected filters in the drop-down menu.
  2. If you want to execute the query again, click the Query button.
    The selected filter is deleted and the Events List is refreshed.
You are here
Table of Contents > Analyzing Raw Events and Meta Data in the Event Analysis View > Filter Results in the Event Analysis View

Attachments

    Outcomes