Selecting and Investigating Events in Active Channels

An active channel is a grid view in which there is a row for each event. In an active channel you can select which events you want to investigate. After selecting one or more events in the channel, you can perform several analysis and authoring tasks.

Topics include:

• Selecting Events in the Active Channel

• Showing Event Details and Rule Chains

• Running Recon Searches

• Investigating Session Events

• Collaborating on Events (Event Annotation)

• Working with Event Payloads

• Exporting Data Fields to a CSV File

• Getting Knowledge Base Articles