NetWitness Chart Rules and Dashboard Information mismatch

[faizanmehboob]

Hi,

I have created a Rule for Inbound emails and tested it, following are the observations which are causing incorrect numbers.

- The rule when tested returned 124 emails from that specific sender.

- When this rule was incorporated in Dashlet then it returned only 39 from that same sender.

- After that, we checked in the Email Gateway (separate solution), we found out that there are 334 emails.

Using PIE chart for display and using Last 4 Hours to avoid any confusions.

Technically speaking, all numbers should match and since the reliance is on Email Gateway so please let us know what is the cause of these problems?

If we forget about the Email Gateway events count for emails then still NetWitness Data has conflict.

Please advise.

Thanks,

[JohnKisner · Accepted solution]

faizanmehboob,

Are you retrieving exchange logs or are you just looking at captured emails from a network decoder?

The reason this is important is that sometimes emails can be received and sent by your exchange server in bursts. What this does if seen by a packet decoder is cause it to appear as a single session with multiple emails in it. This can cause the packet decoder to misinterpret the situation when it is parsing data from the email stream as it will not seem them as separate emails but instead as a single email that contains several actual emails.

PREVIEW

[faizanmehboob]

Logically speaking, this was what we were experiencing and hence the difference in the count or events.