Can I build a url to display an event based on sessionid?

[NielsVanEijck]

I want to build a url that shows a NetWitness user the event details in the investigate module. So something like:

https://nwserver/investigation/<serviceid>/events?sessionid="<id>"

Is this possible?

[Anonymous]

Yes!

You are almost there 🙂

https[:]//nwserver/investigation/<deviceid>/reconstruction/<sessionid>/AUTO

AUTO can also be changed to TEXT and other display methods depending on your preference... It would match the same options you see on the session reconstruction views.

Hope this helps!

Cheers,

Rui

[NielsVanEijck]

Hi Rui,

Thanks! This link to event reconstruction was already known to me. Because of legal reasons we would like to have a link to the event details only (so only the metadata). Is that also possible?

In the meantime, do you know the proper replacement key for AUTO to show only metadata? I tried META but that doesn't work

Cheers, Niels.

[Anonymous]

Hi Niels,

The correct ending is /DETAILS not META it tricked me too 🙂

But as you probably already know it can easily be changed, not sure there is an option that would only show you meta always and never the payload unless limited by ACLs I would start there. 

Hope this helps!

Rui