.png?width=180&height=32&name=NW%20Logo%20(2).png){kind=small}
Events View - Host Tab
The Host tab is in the Event Details panel. Here you can view network events enriched with endpoint data such as host and process triggered for the selected network event and other details such as risk score, reputation, and logged in user. The host panel is available for network events with endpoint data only.
Workflow
What do you want to do?
- User Role:
Incident Responder or Threat Hunter
- I want to ...:
review detections and signals seen in my environment
- Show me how:
NetWitness Platform Getting Started Guide
- User Role: Incident Responder
- I want to ...:
review critical incidents or alerts
- Show me how:
NetWitness Respond User Guide
- User Role: Threat Hunter
- I want to ...: query a service, metadata, and time range
- Show me how:
Begin an Investigation in the Events View
Begin an Investigation in the Navigate or Legacy Events View
- User Role: Threat Hunter
- I want to ...:
view metadata
- Show me how:
- User Role: Threat Hunter
- I want to ...:
view sequential events
- Show me how:
- User Role:
Threat Hunter
- I want to ...:
reconstruct and analyze an event*
- Show me how:
- User Role: Threat Hunter
- I want to ...: examine files and associated hosts
- Show me how:
Download Data in the Events View
- User Role: Threat Hunter
- I want to ...: perform lookups*
- Show me how:
- User Role: Threat Hunter
- I want to ...: create an incident or add to an incident
- Show me how:
- User Role:
Threat Hunter
- I want to ...:
add a meta value to a Context Hub list
- Show me how:
*You can perform this task in the current view.
Related Topics
- How NetWitness Investigate Works
- Events View - Packet Tab
- Events View - Text Tab
- Events View - File Tab
- Events View - Email Tab
- Events View - Host Tab
Quick LookQuick Look
Below is an example of the Host panel with labeled features.
- Column 1: 1
- Column 2:
The event header displays the summary of network events enriched with endpoint data. It includes:
- Host - The host from where the event originated.
- Process - The source process which triggered the event.
- User - The user associated with the triggered process.
- Column 1: 2
- Column 2:
You can view additional details about the host and process. For more information, see Host Information.