In the Investigate dialog, analysts can select a service or a collection to investigate.
The dialog is automatically displayed when you first go to the Navigate or Events view and have not selected a default service to investigate. To access the dialog from a current investigation, select the current service name in the toolbar.
The Investigate dialog has two tabs: Services and Collections.
Note: Collections are also known as workbench collections. You can only view workbench collections that you have created, and only administrators can create a workbench collection.
The Services tab includes a list of services available for investigation, and three buttons. All features are described in the following table.
Clicking this button sets or clears the default service to investigate. When a service has been set as the default service, the word (Default) is appended to the service name.
The name of the service.
The IP address of the service.
The type of service.
Closes the dialog.
Opens the selected service in the Navigate or Events view.
The Collections tab has two buttons and two panels: Workbench and Collections.
The Workbench panel lists available Workbench services. Once a Workbench service is selected, you can select a collection from the Collections panel. The name is the name of the Workbench service.
The Collections panel lists available collections to investigate. Once a collection is selected, you can click Navigate to view the collection.
The following table describes the features of the Collections panel.