Manage Default Meta Keys Dialog

In the Manage Default Meta Keys dialog, analysts can specify the meta keys to be displayed in the Navigate view > Values panel (see Manage and Apply Default Meta Keys in an Investigation. This can help you find the desired data more quickly and prevents the loading of meta keys that are not of interest. To access this dialog, in the Navigate View toolbar, select Meta > Manage Default Meta Keys.

Related Topics

Quick Look

The following figure illustrates the Manage Default Meta Keys dialog, which has a list of meta keys, toolbar, Close button, and Apply button. In the list, you can view, sort, and manage default meta keys. If you click and drag meta keys, you can rearrange their order. The following table describes columns in the list.

netwitness_mandmetakeys_299x339.png

Column Description
Meta Key This column displays the meta keys available for the service. In Version 11.1 and later, default meta entities are also included, for example All Domain Keys and All Email Address Keys.
View This column displays the type of view assigned to each meta key. By clicking on the view in each row, you can assign the meta key a different default view. There are four views:
  • Auto: Reverts to the default view for meta keys as specified in the service index file.
  • Close: The values of this meta key are closed by default, and can be opened manually.
  • Hidden: These meta keys are hidden by default, and are not shown in Investigation at all.
  • Open: The values of this meta key are displayed by default.
    When you modify the default meta keys for a non-indexed meta key, you cannot set the key to Open. If you change the default view for a group of meta keys to Open and some of the meta keys are non-indexed, the non-indexed meta keys revert to Auto. As a result, the meta key is automatically loaded only if it is indexed, and non-indexed meta keys are Closed until opened manually.

The following table describes the toolbar options and buttons.

Feature Description
netwitness_actiondd.png Displays a drop-down menu that allows you change the default view of all the meta keys. There are four views:
  • Auto: Reverts to the default view for meta keys as specified in the service index file.
  • Close: The values of this meta key are closed by default.
  • Hidden: The values of this meta key are hidden by default.
  • Open: The values of this meta key are displayed by default.
Close Closes the dialog. Any unsaved changes are lost.
Apply Applies the changes, and they become effective immediately.