Context Lookup Panel

After an administrator configures the Context Hub service, you can view the contextual information for the meta values in the Navigate view, Legacy Events view, and Events view. The Context Hub service is pre-configured with a default meta type and meta key mapping. For information about mapping of the context hub meta value with investigation meta key, see "Manage Meta Type and Meta Key Mapping" in the Context Hub Configuration Guide.

The Context Lookup panel is displayed on the right side of the Navigate view, Legacy Events view, or Events view. Meta values that have been added to a Context Hub list are highlighted in gray in the Navigate view or Legacy Events view results. In the Events view, they are marked by an underscore. When you right-click a highlighted value and select Context Lookup in the resulting context menu, the lookup results are displayed in the Context Lookup panel for configured sources for the selected meta value. You can select a source in the Context Lookup panel icon bar to view the contextual information.

There are some differences between the appearance and contents of the Context Lookup panel when open in the Navigate view or Events view and when open in the Events view.

Note: The contexthub-server.contextlookup.read permission is enabled only for Administrators, Analysts, Malware Analysts, SOC Managers and Respond Administrators. Administrators can enable this permission for other roles in the Respond view to view context lookups for meta values and perform the Add/Remove from List actions. For more information, see the "Role Permissions" topic in the System Security and User Management Guide.

What do you want to do?

Workflow

netwitness_wkflow-lookups.png

What do you want to do?What do you want to do?

User Role I want to ... Show me how

Incident Responder or Threat Hunter

review detections and signals seen in my environment

NetWitness Platform Getting Started Guide

Incident Responder

review critical incidents or alerts

NetWitness Respond User Guide

Threat Hunter query a service, metadata, and time range
Threat Hunter

view metadata

Threat Hunter

view sequential events

Threat Hunter

reconstruct and analyze an event

Threat Hunter examine files and associated hosts
Threat Hunter perform lookups*
Threat Hunter create an incident or add to an incident

Threat Hunter

add a meta value to a Context Hub list

Look Up Additional Context for Results

*You can perform this task in the current view.

Related TopicsRelated Topics

Quick Look (in the Navigate and Legacy Events Views)

The following figure is an example of the Context Lookup panel as it appears in the Navigate view. Controls and features are described in the table.

122_NavVwCtxPnl_1122.png

Feature Description
Source Options Bar Displays the icons for the available sources: Endpoint, Incidents, Alerts, and Lists.
Source Name Displays the source name based on the selected icon:
  • Endpoint
  • Incidents
  • Alerts
  • Lists
Sort

Provides a drop-down of sort options for the listed context information. Possible sort options are Severity - High to Low, Severity Low to High, Date - Oldest to Newest. and Date - Newest to Oldest. The sorting options vary by source type.

netwitness_ic-refresh.png Refreshes the lookup results.
<n items> (First <n> Results) The footer provides a count of results currently displayed and the total number of results. For example, 5 Alerts (First 50 Results).

IncidentsIncidents

Incidents are displayed based on time first (Newest to Oldest) and then priority status. The following information is displayed for incident lookups:

  • Incident Name and ID
  • Priority status of the incidents
  • Risk Score value of the incidents
  • Date when the incident was created
  • Status of the incident
  • Assignee for the incident
  • Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
  • Time window: This is based on the value that is set for the "Query Last (Days)" field in the Configure Respond window. For details, see the "Configure Respond as a Data Source" topic in the Context Hub Configuration Guide.
  • Sort: This drop-down field provides options to change the sorting of result based on time or priority.

Alerts

Alerts are displayed based on the Severity. ;The following information is displayed for alert lookups:

  • Alert Name
  • Severity value of the alerts
  • Date when the alert was created
  • Incident ID: This is the ID of the incident that the alert is associated with (If any).
  • Sources: Event source name
  • Number of events associated with the alert.
  • Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
  • Time window: This is based on the value that is set for the "Query Last (Days)" field in the Configure Respond window. For details, see the "Configure Respond as a Data Source" topic in the Context Hub Configuration Guide
  • Sort: This drop-down field provides option to change the sorting of result based on time or priority.

Lists

The following information is displayed for list lookups.

  • List Name
  • Owner who created the list
  • Created Date
  • Last Updated Date
  • Description of the list

Endpoint

The following information is displayed for Endpoint lookups.

  • Machine name and IP address of the machine.
    By clicking on the IP or Endpoint machine name, you will be navigated to Endpoint UI to perform further investigation.
  • Last Updated: Indicates when contextual data was last fetched from data source and updated to cache.
  • Machine Score: A machine IIOC score is aggregated based on the module scores.
  • Number of modules: Number of active files for the selected machine.
  • Last Updated: Indicates when the scan results were last updated in Endpoint database.
  • Last Login User
  • Machine MAC Address
  • Operating System Version
  • Admin Notes (if any)
  • Admin Status (if any)
  • Top Suspicious Modules (Modules that have an IIOC score > 500). This is based on the value set for "Minimum IIOC Score" field in the Configure Endpoint window. The default value for "Minimum IIOC Score" is 500.
  • Machine IIOC Levels

Quick Look in the Events View

The following figure is an example of the Context Lookup panel as it appears in the Events view.

122_contextup12_1122.png

The contextual information or query results displayed in the Context Lookup panel depends on the selected entity and the associated data sources. The Context Lookup panel has separate tabs for each of the data sources. The tabs are: List data source, Archer, Active Directory, Endpoint, Incidents, Alerts, and REST API. The following figure shows the Context Lookup panel for a selected entity in the Incident Details view.
netwitness_contextpanel_2_114_960x486.png

The following table describes the data available on each tab and the supported entities.

Tab Description Supported Entities

netwitness_ch_list.png
(Lists)

Displays all of the list data associated with the selected entity or meta value. The result is sorted by the last updated list.

All entities

netwitness_ch_archer.png
(Archer)
Displays asset information along with criticality ratings using the Archer data source. IP, Host, and Mac

netwitness_ch_ad.png
(Active Directory)

Displays all user information for the selected user.

User

netwitness_ch_endpt.png
(NetWitness Endpoint)



Displays the NetWitness Endpoint data source information for the selected entity or meta value, which includes the Machines, Modules, and IIOC levels. Modules are by highest IOC score to lowest IIOC score and IIOC levels are sorted by highest IOC levels to lowest IOC levels. IP, MAC address, and Host
netwitness_ch_inc.png
(Incidents)
Displays the list of incidents associated with the selected entity or meta value. The result is sorted by newest incidents to oldest incidents.

All entities

netwitness_ch_alert.png
(Alerts)
Displays the list of alerts associated with the selected entity or meta value. The result is sorted by newest alerts to oldest alerts. All entities
netwitness_ch_live.png
(Live Connect)
Displays information related to Live Connect.

IP, Domain, and Filehash

netwitness_flrepds.png

(File Reputation)

Displays file reputation status for Filehash entities. Filehash entities

netwitness_stixicon_44x42.png

TI

Displays information for STIX data sources.

IP address, email address, domain, filename, URL's, and file hash.

Note: The context lookup for email address and URL will be displayed only if these metas are mapped. Navigate to netwitness_adminicon_25x22.png (Admin) > System > Investigation > Context Lookup.

 

REST API

Displays the list of REST APIs (enabled in Context Hub) associated with selected the entity. All entities

 

Lists Tab

The Context Lookup panel for Lists shows one or more lists associated with the selected entity or meta value. The following figure is an example of the Context Panel for Lists, and the table describes the fields.

contexhub_lists_view.png

Field Description
Name The name of the list (defined while creating the list).
Description The description of the list (defined while creating the list).
Header Displays the metas available for the list.
Value Displays the values for each meta in the list.
Author The owner who created the list.
Created The date when the list was created.
Updated The date when the list was last updated or modifed.
Count The number of lists in which the selected entity or meta value is available.
Time Window The time window based on the value set for the "Query Last" field in the Configure Responses dialog. By default, all Lists data is fetched.
Last Updated The time when Context Hub fetched and stored the lookup data in cache.

Archer Tab

The Context Lookup panel for Archer displays asset information along with criticality ratings using the Archer data source for IP, Host, and Mac entities. The following figure is an example of the Context Lookup panel for Archer, and the table describes each field.

netwitness_archercontext_2_768x360.png

Field Description
Criticality Rating The device operational criticality based on the applications it supports. The criticality ratings can be set as Not Rated, Low, Medium-Low, Medium, Medium-High, or High.
Risk Rating The calculated risk rating for the device based on the most recent assessment and the average risk rating of facilities using the device. The risk rating can be set as Severe, High, Medium, Low, or Minimal.
Device Name The unique name of the device.
Host Name The host name of the device.
IP Address The primary internal IP address of the device.
Device ID The automatically populated value that uniquely identifies the record across all applications within the system.
Type The device type, for example, server, laptop, desktop, and others.
Facilities Links to records in the Facilities application that are related to this device.
Business Unit Links to records in the Business Unit application that are related to this device. For more than three business unit values, you can hover over the field to view the values.
Device Owner The person who is responsible for the device and receives read and update rights of the record.

Count

The number of assets available.

Time Window

The time window based on the value that is set for the "Query Last" field in the Configure Responses dialog. By default, all data for Archer is fetched.
Last Updated The time when Context Hub fetched and stored the lookup data in cache.

Note: In the localized versions, only these twelve fields are displayed: Criticality Rating, Risk Rating, Device Owner, Business Unit, Host Name, MAC Address, Facilities, IP Address, Type, Device ID, Device Name, and Business Processes.

Active Directory Tab

The following figure is an example of a Context Lookup panel for Active Directory.

netwitness_ctxpnl_ad_960x483.png

The Context Lookup panel for Active Directory displays all the related information, incidents, and alerts for a user. You can perform a look up using the following formats:

  • userPrincipalName
  • Domain\UserName
  • sAMAccountName

The following information is displayed for Active Directory.

Field Description

Display Name

The name of the user.

Employee ID

The employee ID of the user.

Phone

The phone number of the user.

Email

The email ID of the user.

AD User ID

The unique identification of the user within an organization.

Job Title

The designation of the user.

Manager

The name of the user's manager.

Groups

The list of groups of which the user is a member.

Company

The name of the user's company.

Department

The department name to which the user belongs within the organization.

Location

The location of the user.

Last Logon

The time when the user logged into the system, only if the Global Catalogue is defined.

Last Logon TimeStamp The time when the user logged into the system.
Distinguished Name The unique name assigned to the user.
Count

The number of users.

Time Window

The time window based on the value that is set for the "Query Last" field in the Configure Data Source Settings dialog. By default, all data for Active Directory is fetched.

Last Updated

The time when Context Hub fetched and stored the lookup data in cache.

NetWitness Endpoint Tab

The following figure is an example of the Context Lookup panel for NetWitness Endpoint.

netwitness_context-panel_960x584.png

The following information displayed for IIOCs.

Field Description
# Of Modules The number modules that are looked up.
Admin Status The admin status (if any).
Last Updated The time when the data was last refreshed.
Last Login The time when the user last logged in.
MAC Address The Machine MAC Address.
Operating System The Version of the Operating System used by the NetWitness Endpoint machine.
Machine Status The state of the module being viewed: Online, Offline, Active, or Inactive.
IP Address The IP address of the specific module.

The following information is displayed for modules.

Field Description
IIOC Score A machine IIOC score is an aggregated score based on the module scores. This is based on the value set for Minimum IIOC Score field in the Context Hub Data Source Settings dialog. The default value for Minimum IIOC Score is 500. See "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide.
Module Name The name of the module that is being looked up.
Analytic Score The number of active files for the selected machine.
Machine Count The number of machines on which that particular IOC got triggered.
Signature Indicator of whether the file is signed or unsigned, valid or invalid, and signatory information. For example, Google, Apple, and so on.

The following information is displayed for machines.

Field Description

IOC Levels

The IOC levels.

Description The description for he IOC level if available.
Last executed The time when the action was executed.

Count

The number of hosts that are being looked up.

Time Window The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, all data for NetWitness Endpoint is fetched.
Last Updated The time when scan results were last updated in NetWitness Endpoint database.

Alerts Tab

The following figure is an example of Context Panel for Alerts that is displayed based on time first (Newest to Oldest) and then severity.

netwitness_ctxpnl_resp_alerts_114_960x485.png

The following information is displayed in the Context Lookup panel for Alerts.

Field Description
Created The date and time when the alert was created.
Severity The severity value of the alerts.
Name The name of the alert. You can click the name to view the details of a specific alert.
Source The alert source name from which the alert is triggered.
#Events The number of events associated with the alert.
Incident ID The ID of the incident (if any) with which the alert is associated. You can click the ID to view the details of a specific alert.

Count

The number of alerts. By default only the first 100 alerts are displayed. For more information on how to configure the settings, see "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide.

Time Window

The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, the alert data for last 7 days is fetched.

Last Updated The time when contextual data was last fetched from data source.

Incidents Tab

The following figure is an example of the Context Panel for Incidents, which is based on time first (Newest to Oldest) and then priority status.

netwitness_ctxpnl_incidents_114_960x486.png

The following information is displayed in the Context Lookup panel for Incidents.

Field Description
Created The date when the incident was created.
Priority The priority status of the incidents.
Risk Score The risk score of the incidents.
ID The Incident ID of the incident. You can click on the ID to display further details about the incident.
Name The incident name.
Status The status of the incident
Assignee The current owner of the incident.
Alerts The number of alerts associated with the incident.

Count

The number of incidents. By default only the first 100 incidents are displayed. For more information on how configure the settings, see "Configure Context Hub Data Source Settings" in the Context Hub Configuration Guide.

Time Window

The time window based on the value set for the Query Last field in the Configure Data Source Settings dialog. By default, the alert data for last 7 days is fetched.

Last Updated The time when contextual data was last fetched from data source.

File Reputation Tab

The Context Lookup panel for File Reputation displays the file reputation status of a file.
netwitness_cntxtflrp_960x379.png

Field Description
Reputation Status Reputation Status of filehash. For more information about reputation status, see "View Reputation of files" in the UEBA User Guide.
Scanner Match Number of scanners that detected malware or suspicious activity in the last scan.
Classification Platform Classification for the queried filehash based on the platform. For example, the platform can be Win 32.
Classification Type Classification for the queried filehash based on the type.
Classification Family Classification for the queried filehash based on the malware family name.

TI Tab

The following figure is an example of a Context Panel for TI, and the table describes the information displayed.netwitness_ctxpnl_stix_115_1046x676.png

Field Description

Data Source name

Displays the STIX data source name from where the data is retrieved.

Timestamp The time when the event was created.
Indicator Details

Indicator Title: Displays the details that contains a pattern that can be used to detect suspicious or malicious cyber activity.

ID: Displays the ID of the selected indicator.

Produced by: Displays the user role who requested for the STIX data.
Description: Displays details about the selected IP address which are being watch listed.

Observable

Observable Title: Displays and conveys information about cyber security related entities such as files, systems, and networks using the STIX Cyber-observable Objects (SCOs).

ID: Displays the ID of the selected observable.

(Optional) SightingsREST

Sightings Title: Displays the name of the sighting source.

Confidence: Displays the criticality of the sighting.

Reference: Displays the reference URL of the sighting source.

REST API Tab

The Context Lookup panel for REST API shows HTML or JSON response (based on the response type configured) associated with the selected entity or meta value.

Note: For JSON response type, the fields that are mapped with friendly names (during REST API configuration) are only displayed for context Lookup. If you have not mapped any fields, all fields are displayed for context lookup.

The following figure is an example of the Context Panel for REST API with JSON response:
netwitness_restapi_json.png

The following figure is an example of the Context Panel for REST API with HTML response:
netwitness_restapi_html.png