Investigating Session Events

Session events are captured in session lists, described in:

• Identity Correlation

• Managing Session Lists

This topic explains how to use the Console's Analyze in Channel >Session Events command to refine and explore channels contextually, using attributes of the events already being displayed in active channels.

You can investigate session list entries two ways:

• Filter the set of entries based on the attributes of a particular entry, or

• Create an Investigation Channel that contains only the entries that match one or more attributes of the initial session list entry.

To investigate a session event:

Where: Navigator > Resources > Lists > Session Lists tab

1. Right-click a session list and select Show Entries.

2. In the Viewer panel, click an entry that bears investigation.

3. Right-click the selected entry. The menu includes commands to Create Channel and Add Condition to Channel Editor. The details of each command will vary based on which column you right-click.

   For example, if you right-click a Source IP column containing the value 192.0.2.0, the choices are:

• Create Channel (Source IP = 192.0.2.0)

• Create Channel (Source IP != 192.0.2.0)

• Create Channel >

• Add Condition to Channel Editor (Source IP = 192.0.2.0)

• Add Condition to Channel Editor (Source IP != 192.0.2.0)

• Add Condition to Channel Editor >

  The sub-menus (indicated by the >) offer similar choices for all the other columns of the Session List entry.

  If you select Create Channel, a channel is added to the Viewer panel. If you select Add Condition to Channel Editor, a channel editor will open in the Inspect/Edit panel.

For more information about creating and using views for investigation, see Investigating Views.