RSA NetWitness v11.2 introduced a very useful feature to the Investigation workflow with the improvement of the Profile feature. In previous versions the Profile could have a pre-query set for it along with the meta and column groups, but you were locked to using only those two features unless you de-activated your profile.
With v11.2 you are able to keep the pre-query set from the profile and pivot to other meta and column groups. This ability allows you to set the Profiles as bookmarks or starting points for investigations or drills. Along with the folders that can be set in the Profile section to help organize the various groups that help frame investigations properly.
Below is a collection of the profiles as well as some meta and column groups to help collect various types of data or protocols together.
GitHub - epartington/rsa_nw_investigation_profiles
Protocols
Medium
Log Device Classes
UEBA
Let me know if these work for you, I will be adding more as they develop to the github site so check back.
