Siren Platform User Guide

Filtering the context

Depending on how the documents are partitioned into index patterns, the context view may contain many documents not related to the event under investigation. To adapt the focus of the context view to the task at hand, you can use filters to restrict the documents considered by Siren Investigate for display in the context view.

When switching from the Discover view to the Context view, the previously applied filters are carried over. Pinned filters remain active while normal filters are copied in a switched off state. You can selectively re-enabled them to refine your context view.

New filters can be added using the Add a filter link in the filter bar, by clicking the filter icons appearing when moving the mouse pointer over a field, or by expanding documents and clicking the filter icons in the table.

Discover context view filter montage.

Search results

    No results found