In the Investigate dialog, analysts can select a service or a collection to investigate.
The dialog is automatically displayed when you first go to the Navigate or Events view and have not selected a default service to investigate. To access the dialog from a current investigation, select the current service name in the toolbar.
Features
The Investigate dialog has two tabs: Services and Collections.
Note: Collections are also known as workbench collections. You can only view workbench collections that you have created, and only administrators can create a workbench collection.
Services Tab
The Services tab includes a list of services available for investigation, and three buttons. All features are described in the following table.
Default Service | Clicking this button sets or clears the default service to investigate. When a service has been set as the default service, the word (Default) is appended to the service name. |
Name | The name of the service. |
Address | The IP address of the service. |
Type | The type of service. |
Cancel | Closes the dialog. |
Navigate | Opens the selected service in the Navigate or Events view. |
Collections Tab
The Collections tab has two buttons and two panels: Workbench and Collections.
The Workbench panel lists available Workbench services. Once a Workbench service is selected, you can select a collection from the Collections panel. The name is the name of the Workbench service.
The Collections panel lists available collections to investigate. Once a collection is selected, you can click Navigate to view the collection.
The following table describes the features of the Collections panel.
|
Name | The name of the collection. |
Type | The type of collection. |
Size | The size of the collection. |
Data Type | The type of data within the collection. |
Date Created | The date the collection was created. |