Basic Components of the Analysis Console

The web console uses several common resources to enable the interaction between the analyst and the service. Below is a description of the console controls and how to use them.

Tab Menu

The tab menu is a menu bar that enables you to select the content shown in the central panel and shows the different modules.

Depending on the selected zone, you can configure the tab menu and these settings are then maintained to enable analysts to continue the task where they left off.

Configurable tab menu

  • To select one of the available modules, click its name.

  • To create a new entry in the tab menu, click the icon

  • To delete an entry from the tab menu, place your cursor over the entry you want to delete. Click the icon. The module and all its information are deleted

Other tab menus are not configurable and look like the menu shown in figure Fixed tab menu

Fixed tab menu

Sub-panels

When the central panel has different types of information, the page divides into sub-panels.

Indicators sub-panel in an investigation

You can maximize sub-panels to take up the whole page if there is a large amount of data shown.

  • To maximize a sub-panel, click .

  • To minimize a sub-panel, click .

Some sub-panels have their own tools for searching and filtering, which affect only data in the sub-panel. See Search Tools.

Tools for Configuring Lists

Lists in Cytomic Orion are totally configurable to make reading the presented data easier for analysts. The tools available for configuring lists are described below. You can access the majority of the configuration tools through the context menu that appears when you place your cursor over the column header.

Select All the Items in a List

Select the checkbox in the header of the list to select the visible and non-visible items.

The checkboxes allow several status types:

Icon Description

Unselected item

Selected item

All the items in the list or group are selected.

Some (not all) the items in the list or group are selected.

Checkbox status

Sort Columns

To change the order of a column in a list, click the name of the column and drag and drop it to its new position.

Add or Remove Columns

To show or hide columns in a list, follow these steps::

  • Click the context menu icon for a column. A drop-down menu with several tabs appears.

  • Select the tab. Select the columns you want to show in the list.

  • To quickly find a column within the drop-down menu, use the Filter text box. The list of available columns updates automatically.

  • After you have selected the columns, click anywhere on the page. The list updates automatically with the new column settings.

Group Entries by Columns

At the top of the list, the group bar is shown (1). This is a recipient control where analysts can drag the columns that make up the grouping criteria.

List grouped by the MUID and Hunting rule columns

To group the list results by one column, drag the column name to the grouping control (1), or follow these steps:

  • Click the context menu icon for a column. A drop-down menu with several tabs appears.

  • Select the tab. Select the Group by (name of the column) option.

After you have created the new group, the list updates with these changes:

  • A column is created on the left side of the list with the “group” name. This column show the content of the groups (2).

  • The columns selected as grouping criteria appear on the group bar in the order in which they were added (3).

  • The icons and are added to expand or collapse a group of results.

  • To delete a group, click the icon of the group you want to delete from the group bar.

  • If the grouping criteria is made up of more than one column, the order selected is respected: The list is grouped by the column chosen first and, within each group of resulting rows, it is grouped again by the second column, and so on.

  • To change the order in which a group appears, click its name and drag it to the left or right in the group bar.

  • To change the order of the groups in accordance with the number of items they contain, click the name of the Group column.

Select All the Items in a Group

To select all the items that belong to a group, select the checkbox (4) associated with the group.

You cannot select multiple groups of the same level at the same time. When you select a group, the console cancels the rest of the selections.

Pin Columns

In lists where there is a large number of columns, you must use the horizontal scrolling bar in to see the columns that do not fit on the page. To pin a column, select the Pin column option.

  • Click the context menu icon for a column. A drop-down menu with several tabs appears.

  • From the context menu, select the tab.

  • Select Pin column . Choose where to place the column: to the left or to the right.

  • To restore a previously pinned column, select the No pin option.

Resize Columns

To change a column width, click the separating icon between the names of the columns. Drag it to the right or to the left

Resize Columns according to Their Content

To adapt a column width to its content, follow these steps:

  • Click the context menu icon for a column. A drop-down menu with several tabs appears.

  • Select the tab. Select the Autosize this column option.

  • To adjust the width of all columns, select Autosize all columns.

Filter Information at Column Level

To filter the list rows according to the content of a specific cell, follow these steps:

  • Click the context menu icon for a column. A drop-down menu with several tabs appears.

  • Select the tab. Select a filter criteria.

Depending on the type of data stored in the column, different filter criteria are available:

  • For date-type columns: Enter two dates to show the range of entries within the set interval, or enter a single date to show the entries that correspond to that date.

  • For text-type columns: Enter the text that will serve as the filter and the filter logic: Equals - Not equal for exact matches, Contains - Does not contain for partial matches at any point of the character string, and Starts with - Ends with for matches at the beginning or at the end of the character string.

  • For number-type columns: Select the enumeration items that will serve as the filter.

Restore Column Settings
  • Click the context menu icon for a column. A drop-down menu with several tabs appears.

  • Select the tab. Select the Reset columns option.

Show and Hide Columns and Filters

Lists incorporate a sidebar with two shortcuts that enable you to:

  • Quickly show and hide columns and filters in the list.

  • Quickly sort columns in the list.

  • Show columns in the event that they were all previously hidden by mistake.

Bar with shortcuts to columns and filters in a list

Search Tools

Search tools show the most relevant data for analysts. To perform a global search on a list, enter the text strings you want to search for in the text box. Click the icon.

Unlike Tools for Configuring Lists, where filters were applied to certain columns, this section describes the search tools that apply to all the columns in the corresponding list.

These features are common to the search tools:

  • Partial searches are permitted, with the beginning, middle, or end of a text string.

  • The search covers all the columns in the list.

  • The search applies to the list in the corresponding panel or sub-panel. Figure Search controls associated with a panel list shows three search controls (1, 2, and 3) associated with their respective panels (1, 2, and 3).

Search controls associated with a panel list

Filter Tools

These are controls that enable you to select values that are applied as a filter to a list. They appear in the left panel in some console areas. The filters displayed depend on the console area and its lists.

Filter controls

Frequent filter tools are:

  • Status filters (1): They filter entries by a certain status.

  • Date filters (2): They filter entries by a time range.

Context Menus

These shows groups of options to aid the work of analysts. Some context menus are represented by the icon, but others are shown only when you right-click a console item. For example, when you right-click an indicator from the list in an investigation, you have the option to open the investigation console with the computer identifier and the date of the indicator.

Investigations area context menu and icon

Tool for Converting a Computer Name to an MUID

Cytomic Orion uniquely identifies clients’ computers by using a character string comprising groups of letters and numbers separated by a hyphen. This makes it possible to reference computers unambiguously, bearing in mind that a specific computer name can be used by multiple clients managed by the same SOC. To simplify management of devices and avoid memorizing MUIDs, Cytomic Orion provides a conversion tool that translates a computer name (easier to remember for analysts) to its corresponding MUID. This tool is invoked through the icon in text boxes where you must enter an MUID. The tool works as follows:

Tool for converting computer names to MUIDs

  • In the Client text box (1), enter the SOC client to which the computer belongs.

  • Enter a character from the computer name in the Search computer (2) text box. The text box (4) automatically shows the names of the computers with those characters.

  • To filter the results, use the search text box (3).

  • Select the computer and click Select. The MUID of the computer is copied to the text box from which you invoked the name conversion tool.

Multi-value Text Boxes

Some text boxes enable analysts to enter lists of values they can enter manually or by pasting them from the clipboard:

  • From the clipboard: Press control + v to paste the contents of the clipboard. Separate the values in the list by the character “,” so that the console can interpret them as independent items.

  • With the icon associated with the text box: Click this icon. A dialog box opens where you can select the items you want to include.

Other Controls
Icon Description

Adds an item.

Deletes an item.

Changes the status (enabled or disabled) of an item.

Refreshes the content of the associated panel.

Exports the results shown in the associated panel to CSV format.

Sets the time zone. In a list of items, it adapts dates to the selected time zone. In text boxes, it enables you to set a time zone for searches.

Other controls used in the analysis console