Investigations Overview

The Investigations section on Portal is available to investigate and query journeys and events processed by Darwinium.

The investigations functionality is intended for searching and reviewing details about the events processed by Darwinium

Query View

See Query View.

The Query view is the best place to searches and find journeys that have gone through the Darwinium risk decision engine.

Events are searched over using the Darwinium Query Language. 

The event sidebar can be triggered upon double clicking any row of data in the table.

The event sidebar works best to analyse the specific details about the Darwinium event like:

• What was the Darwinium decision and why

• What signals and scores evaluated on the event

• What was the email/device/ip/location/device forensics on this event

Tip: Full event data

You can also right-click a row of data -> show raw event data to see and search on the full event blob

Event Sidebar: Filtering

Additionally, the event sidebar is a useful way of forming queries without needing to know the search syntax;

Hover over any attribute value in the sidebar to see a menu that adjusts your Investigations Search query automatically.
It will populate with the attribute name and the correct function when searching for that attribute type.

• Filter:Value (Add to Query): use AND to add this attribute value check to search  

• Replace Query (Replace Query): delete current search and replace with this attribute value check

• Filter:Condition (Add to Query): If a derived attribute (like a signal), use AND to add the underlying condition to search

• Filter:Condition (Replace Query): If a derived attribute (like a signal), delete current serach add replace with the underlying condition to search