2015-09-02 06:24 PM
I was wondering if there were ways, or if there were plans to offer alternative layouts to the investigation view? (if not, feature request please!)
2015-09-03 07:46 AM
The thing I'd like to see is an ability to add one or more keys to an existing view.
2015-09-09 02:16 PM
What about leveraging the Meta Groups? This option, in Investigations, lets you customize the meta keys displayed in the Navigate window. You can also define whether they are opened or closed when you first bring them up. This helps as you may only want to open or see 5 or 10 meta keys for an initial triage but then open up MORE meta keys as your investigation deepens.
In addition to Meta Groups, you can also define Meta Column Groups in the Events view.
By creating your own views, you can get to the data you need a little faster without having to open up meta keys that aren't relevant to the current investigation. You can create several different meta groups and Column groups based on your different needs and use cases.
Hope this helps.
Chris
2015-09-09 06:26 PM
Yup - I use these meta groups with Profiles. Still not quite what I'd want.