Perform Details Searches (User/Host)
A user or host details search is the same as a regular web investigation with predefined criteria. You can start a detail search in the Inspector panel by clicking the View Details button on User and Host fields.
A details search can be run from the following user fields:
- User (Origin)
- User (Origin) Identity
- User (Impacted)
- User (Impacted) Identity
- Sender
- Sender Identity
- Recipient
- Sender Identity
A details search can be run from the following user fields:
- Host (Impacted)
- Host (Origin)
- IP address (Impacted)
- IP address (Origin)
- Hostname (Impacted)
- Hostname (Origin)
- Known Host (Impacted)
- Known Host (Origin)
To adjust the number of hours the details search uses when querying the Data Indexer, go the the Web Console Configuration Manger, scroll to the Web Console UI header, and adjust the value in the Activity Search Range (Hours) field. The default setting is 12.