Record Viewer

The Record Table visualization and the Global Search interface allow you to open an individual record inside a floating, full-height panel, where you can explore it in depth. This panel is known as the Record Viewer. The Record Viewer provides options to view the record or its related data, which can be accessed by the tabs at the top of the panel.

The Record Viewer can also be used to create, edit, or delete a record in an entity table.

To add a record to an existing dashboard, click Filter. This creates a filter in the target dashboard that focuses on that specific record.

The Record details tab

The Record details tab displays all of the record fields and their associated values in a paginated table.

When you open the Record Viewer from a Record Table visualization, the Main fields of the table are those that relate to the record table’s columns. These fields retain the formatting from the original record table.

The Other fields section displays fields that are associated with the record, but are not displayed in the columns of the record table.

Configuring the viewing options

You can use the following viewing options to change how the records are displayed:

  • Show empty: Display empty fields in the Record Viewer.

  • Hide empty: Hide empty fields in the Record Viewer.

  • Fields per page: Select the number of fields that you want to display in the Record Viewer.

If you want to make sure that your viewing options remain the same after you log out of Siren Investigate, you can configure that in the investigate.yml file. Open the investigate.yml file and add the key siren-record-view-options in an array as follows:

investigate_access_control:
  enabled: true
  session_termination_whitelist:
    local_storage_keys: ['siren-record-view-options']

The JSON tab

The JSON tab displays the record as it was retrieved from the records store, as a full-text JSON document.

The JSON document will include the original ingested record under the _source property, as well as other useful properties like the record’s _id, its _index and its _score in the search.

The Linked tab

The Linked tab displays all entities related to the current record, organized in a tree structure. It works the same way that the Graph Browser expands a node to its linked nodes. The relational tree starts with the relations that are set up in the record’s entity table. Each relation displays the number of linked entities. Expand a relation to display the list of linked entities.

Records-as-relations that use field values as a label appear as [*], click it to open the popover with the specific labels. For more information, see Records-as-relations.

Clicking a linked record expands it into a nested Record Viewer. Clicking the rightmost button in the card opens the nested record in a new Record Viewer, making that record the new 'root' record.

The Overview tab

The Overview tab displays perspectives associated with the entity table from the Template scripts tab on the Data Model. These perspectives are used to display a custom Record Viewer or to download the record as a file. You can associate more than one perspective to each entity table or child search. If more than one view perspective is associated, you can change the viewed perspective using the dropdown selector. To download a binary perspective, select the perspective from the Download as…​ options.

To permanently change the order of the view perspectives, you must update the order of the Record Viewer perspectives list from the Template scripts tab of the Data Model.

When opening a record in Record Viewer, the Overview tab only appears if the respective entity table or child search has at least one perspective associated.

For step-by-step instructions on how to create templates and downloadable reports see Templating and reporting.

For more information about managing and editing of Template scripts, see Template scripts.

Navigation history

The navigation steps are saved each time you open the Record Viewer and navigate the records using template scripts on the Overview tab or visit records from the Linked tab. This allows you to move back and forward through your history or resume your investigation from a previous step. The Record Viewer has two history types: local history and global history.

Local history

Local history captures all records explored inside the current Record Viewer panel. It’s represented by breadcrumbs that are visible when you have visited more than one record. To return to a previous step, click the individual breadcrumbs.

You can also use the back and forward arrows located in the upper-right corner to navigate local history. To view all steps in the local history, click and hold an arrow button. From here, you can select a step of the local history and continue your investigation from that point.

Global history

Global history stores recent Record Viewer sessions. Click the history button (clock) in the upper-right corner of the Record Viewer. Sessions are grouped by the context in which you opened the Record Viewer. You can use global history to revisit any recent session and resume your investigation from that step.