Analyze TopX Results

TopX widgets allow you to perform further analysis on the results they contain.

1. From a Personal Dashboard or Investigator results screen, right-click the TopX widget that contains information you want to analyze. Select one of the following
   1. Drill Down. This allows you to drill down on the returned results. Drilling down opens the Investigator tool to the data related to the records selected for the drill down. You can drill down on the following:
      • A single pie slice. Double-click the pie slice record.
      • A single record in the grid. Double-click the single record or select it, right-click on it, and click Drill Down.
      • Multiple records in the grid. Highlight the records for drill down, right-click on them, and click Drill Down.
      

      The Others value can only be drilled down as a single record. It cannot be drilled down with other records in the grid.

   2. Correlate. This allows you to further search within the result set. It works the same throughout the various Analysis tools. Correlate works with the Quick Search toolbar and requires that you have your default Data Processor set within My Preferences. Correlation works with the grid only. It does not work with the pie chart. You can correlate on a single record or on multiple records. For more details on this functionality, see Run Correlate.
   3. Contextualize. This provides information about a host, port, or user for the record selected. It works the same within all Analysis Tools. To use it, you need to have the appropriate field selected. After the field is selected, the Contextualize option is enabled and you can select the option to view more data about the selected field. For more information about this feature, see Run Contextualize.
   4. Add Host as Known Host. This allows you to add the host in the record as a known host. It is the same functionality used throughout the Analysis tools. To use it, you need to have the appropriate field selected. After the field is selected, the Add Host as Known Host option is enabled and you can select the option within the context menu. The Impacted and Origin Host fields are the only fields that enable this option.