Loading evidence2/siem_data.js…
If you opened this page from disk without the evidence folder, use Open files… and select the unzipped log files. The evidence package is on the case page.
How each file was read. A SIEM only knows what a source tells it: if a log has no time zone, the zone configured for that source is assumed, and clock errors of the source are not corrected.
Use them with | lookup employees <field> AS <event field> or
| lookup geoip network AS src_ip.
Select a packet.
Select a message.
Company sites and the GeoIP locations of VPN source addresses (from geoip.csv). A GeoIP
record is a database entry about who registered an address range, with an accuracy radius. It is not a GPS fix.
Click a marker to search for its VPN sessions.
Events you pinned with ☆ in the search results, plus your own notes. Pinned events keep their source time; enter a clock correction in seconds where you know a source's clock was wrong. The list is sorted by corrected time and saved in this browser only, so export it for your report.