Events View - Email Tab
The Email tab is in the Event Details panel. Here you can view a list of email received and associated attachments for an event.
Workflow
Related Topics
- How NetWitness Investigate Works
- Events View - Packet Tab
- Events View - Text Tab
- Events View - File Tab
- Events View - Email Tab
- Events View - Host Tab
Quick Look
The Email panel displays a list of emails associated with a network event. When an analyst opens the email, the email reconstruction is displayed along with the associated attachments and additional header details, if any.
The following figure is an example of an email reconstruction.
The following table describes all the fields within an email.
| Field | Description |
|---|---|
| From | Displays the email address of the sender of the email. |
| To | Displays the email addresses of the recipients of the email. |
| CC (Carbon Copy) | Displays email addresses of additional recipients of the email. The field is displayed only if the sent email has any value and the email addresses are visible to the recipient. |
| BCC | Displays email addresses of additional recipients privately. This field is displayed only if the sent email has any value and the email addresses are not visible to the recipient. |
|
Reply to |
Displays the address designated to receive replies, the sender address. |
| Subject | Displays the subject of the email. |
| Attachments | Displays any files shared by the sender that can be downloaded by the recipient. This field is displayed only if email contains attachments. See Download Data in the Events View for details about downloading email attachments. |
|
Additional Header Details |
Provides additional details of the email event such as Received, Sender, Message-ID and others. |
