Basic Components of the Analysis Console
The web console uses several common resources to enable the interaction between the analyst and the service. Below is a description of the console controls and how to use them.
Tab Menu
The tab menu is a menu bar that enables you to select the content shown in the central panel and shows the different modules.
Depending on the selected zone, you can configure the tab menu and these settings are then maintained to enable analysts to continue the task where they left off.
-
To select one of the available modules, click its name.
-
To create a new entry in the tab menu, click the icon
-
To delete an entry from the tab menu, place your cursor over the entry you want to delete. Click the icon. The module and all its information are deleted
Other tab menus are not configurable and look like the menu shown in figure Fixed tab menu
Sub-panels
When the central panel has different types of information, the page divides into sub-panels.
You can maximize sub-panels to take up the whole page if there is a large amount of data shown.
-
To maximize a sub-panel, click .
-
To minimize a sub-panel, click .
Some sub-panels have their own tools for searching and filtering, which affect only data in the sub-panel. See Search Tools.
Tools for Configuring Lists
Lists in Cytomic Orion are totally configurable to make reading the presented data easier for analysts. The tools available for configuring lists are described below. You can access the majority of the configuration tools through the context menu that appears when you place your cursor over the column header.
Select All the Items in a List
Select the checkbox in the header of the list to select the visible and non-visible items.
The checkboxes allow several status types:
Icon | Description |
---|---|
|
Unselected item |
|
Selected item |
|
All the items in the list or group are selected. |
|
Some (not all) the items in the list or group are selected. |
Sort Columns
To change the order of a column in a list, click the name of the column and drag and drop it to its new position.
Add or Remove Columns
To show or hide columns in a list, follow these steps::
-
Click the context menu icon for a column. A drop-down menu with several tabs appears.
-
Select the tab. Select the columns you want to show in the list.
-
To quickly find a column within the drop-down menu, use the Filter text box. The list of available columns updates automatically.
-
After you have selected the columns, click anywhere on the page. The list updates automatically with the new column settings.
Group Entries by Columns
At the top of the list, the group bar is shown (1). This is a recipient control where analysts can drag the columns that make up the grouping criteria.
To group the list results by one column, drag the column name to the grouping control (1), or follow these steps:
-
Click the context menu icon for a column. A drop-down menu with several tabs appears.
-
Select the tab. Select the Group by (name of the column) option.
After you have created the new group, the list updates with these changes:
-
A column is created on the left side of the list with the “group” name. This column show the content of the groups (2).
-
The columns selected as grouping criteria appear on the group bar in the order in which they were added (3).
-
The icons and are added to expand or collapse a group of results.
-
To delete a group, click the icon of the group you want to delete from the group bar.
-
If the grouping criteria is made up of more than one column, the order selected is respected: The list is grouped by the column chosen first and, within each group of resulting rows, it is grouped again by the second column, and so on.
-
To change the order in which a group appears, click its name and drag it to the left or right in the group bar.
-
To change the order of the groups in accordance with the number of items they contain, click the name of the Group column.
Select All the Items in a Group
To select all the items that belong to a group, select the checkbox (4) associated with the group.
You cannot select multiple groups of the same level at the same time. When you select a group, the console cancels the rest of the selections.
Pin Columns
In lists where there is a large number of columns, you must use the horizontal scrolling bar in to see the columns that do not fit on the page. To pin a column, select the Pin column option.
-
Click the context menu icon for a column. A drop-down menu with several tabs appears.
-
From the context menu, select the tab.
-
Select Pin column . Choose where to place the column: to the left or to the right.
-
To restore a previously pinned column, select the No pin option.
Resize Columns
To change a column width, click the separating icon between the names of the columns. Drag it to the right or to the left
Resize Columns according to Their Content
To adapt a column width to its content, follow these steps:
-
Click the context menu icon for a column. A drop-down menu with several tabs appears.
-
Select the tab. Select the Autosize this column option.
-
To adjust the width of all columns, select Autosize all columns.
Filter Information at Column Level
To filter the list rows according to the content of a specific cell, follow these steps:
-
Click the context menu icon for a column. A drop-down menu with several tabs appears.
-
Select the tab. Select a filter criteria.
Depending on the type of data stored in the column, different filter criteria are available:
-
For date-type columns: Enter two dates to show the range of entries within the set interval, or enter a single date to show the entries that correspond to that date.
-
For text-type columns: Enter the text that will serve as the filter and the filter logic: Equals - Not equal for exact matches, Contains - Does not contain for partial matches at any point of the character string, and Starts with - Ends with for matches at the beginning or at the end of the character string.
-
For number-type columns: Select the enumeration items that will serve as the filter.
Restore Column Settings
-
Click the context menu icon for a column. A drop-down menu with several tabs appears.
-
Select the tab. Select the Reset columns option.
Show and Hide Columns and Filters
Lists incorporate a sidebar with two shortcuts that enable you to:
-
Quickly show and hide columns and filters in the list.
-
Quickly sort columns in the list.
-
Show columns in the event that they were all previously hidden by mistake.
Search Tools
Search tools show the most relevant data for analysts. To perform a global search on a list, enter the text strings you want to search for in the text box. Click the icon.
Unlike Tools for Configuring Lists, where filters were applied to certain columns, this section describes the search tools that apply to all the columns in the corresponding list.
These features are common to the search tools:
-
Partial searches are permitted, with the beginning, middle, or end of a text string.
-
The search covers all the columns in the list.
-
The search applies to the list in the corresponding panel or sub-panel. Figure Search controls associated with a panel list shows three search controls (1, 2, and 3) associated with their respective panels (1, 2, and 3).
Filter Tools
These are controls that enable you to select values that are applied as a filter to a list. They appear in the left panel in some console areas. The filters displayed depend on the console area and its lists.
Frequent filter tools are:
-
Status filters (1): They filter entries by a certain status.
-
Date filters (2): They filter entries by a time range.
Context Menus
These shows groups of options to aid the work of analysts. Some context menus are represented by the icon, but others are shown only when you right-click a console item. For example, when you right-click an indicator from the list in an investigation, you have the option to open the investigation console with the computer identifier and the date of the indicator.
Tool for Converting a Computer Name to an MUID
Cytomic Orion uniquely identifies clients’ computers by using a character string comprising groups of letters and numbers separated by a hyphen. This makes it possible to reference computers unambiguously, bearing in mind that a specific computer name can be used by multiple clients managed by the same SOC. To simplify management of devices and avoid memorizing MUIDs, Cytomic Orion provides a conversion tool that translates a computer name (easier to remember for analysts) to its corresponding MUID. This tool is invoked through the icon in text boxes where you must enter an MUID. The tool works as follows:
-
In the Client text box (1), enter the SOC client to which the computer belongs.
-
Enter a character from the computer name in the Search computer (2) text box. The text box (4) automatically shows the names of the computers with those characters.
-
To filter the results, use the search text box (3).
-
Select the computer and click Select. The MUID of the computer is copied to the text box from which you invoked the name conversion tool.
Multi-value Text Boxes
Some text boxes enable analysts to enter lists of values they can enter manually or by pasting them from the clipboard:
-
From the clipboard: Press
control + v
to paste the contents of the clipboard. Separate the values in the list by the character “,” so that the console can interpret them as independent items. -
With the icon associated with the text box: Click this icon. A dialog box opens where you can select the items you want to include.
Other Controls
Icon | Description |
---|---|
|
Adds an item. |
|
Deletes an item. |
|
Changes the status (enabled or disabled) of an item. |
|
Refreshes the content of the associated panel. |
|
Exports the results shown in the associated panel to CSV format. |
|
Sets the time zone. In a list of items, it adapts dates to the selected time zone. In text boxes, it enables you to set a time zone for searches. |