Visualize search results and take action with nDepth widgets and the Respond menu

About the Explore and Respond menus

The Respond and Explore drop-down menus are located at the top of the nDepth view.

• The Respond menu provides a list of corrective actions you can take in response to an event presented in an explorer, such as shutting down a workstation.
• The Explore menu lists utilities you can use to investigate an event, event detail, or nDepth search result. For more information see Use the explorer utilities in LEM to search or analyze nDepth query results.

Respond to an event with the nDepth Respond menu

Use the actions in the Respond drop-down menu to respond to an issue reported in your nDepth search results. For example, you can block a hostile IP address or send a user account a pop-up message if you see an unusual event.

See About LEM response actions for more information.

1. Run a search in nDepth. See Search normalized data using nDepth search in LEM or Search raw log messages using nDepth search in LEM for help.

2. Select a results entry and then choose a response from the Respond menu at the top of the nDepth page.

About nDepth widgets

nDepth provides a set of default widgets similar to the widgets in the Ops Center.

Each widget represents a high-level graphical view of the specific network activity associated wit h your nDepth search results. The widget displays the primary items generating an activity, as well as the count (or number of incidents) for each item.

Use nDepth explorer views to create new widgets, change the look of existing widgets, add widgets to the nDepth Dashboard, and remove widgets you no longer use. Click refresh  on the widget toolbar to display the latest data from your network.

View widget details

Click or point to an item in the widget to view details and statistics about the item.

Create a search string from a widget item

You can use items in widgets or any of the nDepth graphical tools to create new search strings, or to append existing search strings.

1. On the search bar, click   to delete the existing search string.

2. Click an item on a widget.

   A new search string associated with the widget item appears in search box.

To append an existing search string with an item from a widget, click an item on the widget. In the search box, a new search string associated with the widget item is appended to the existing search string.

Create a new nDepth widget with nDepth Widget Builder

1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

2. Choose Explore > nDepth.

3. Click a view on the nDepth toolbar, such as bar charts, line charts, pie charts, or bubble charts.

   The corresponding view appears.

4. On the view title bar, click  to open the nDepth widget builder.

5. Complete the widget builder selections to configure the new widget.

   The new widget appears at the bottom of the chart view.

   When you configure the widget and choose the Save to Dashboard option, the new widget also appears at the bottom of the nDepth dashboard.

Edit an nDepth widget

1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

2. Choose Explore > nDepth.

3. Click a view on the nDepth toolbar, such as bar charts, line charts, pie charts, or bubble charts.

4. Click  on the widget you want to edit.

5. Use the nDepth Widget Builder to reconfigure the widget.

   The updated widget appears at the bottom of the view.

   When you configure the widget and choose the Save to Dashboard option, the new widget also appears at the bottom of the nDepth dashboard.

6. Click  to refresh the widget data.

Add a chart widget to the nDepth dashboard

You can add an nDepth view (such as word cloud, tree view, or result details) to the nDepth Dashboard. The word cloud, tree view, and result details view display by default. If you remove a view from the dashboard, use this procedure to restore the view.

1. Open the LEM console. See Log in to the LEM web console or Log in to the LEM desktop console for steps.

2. Choose Explore > nDepth.

3. Use the nDepth explorer toolbar to open the chart view you want to work with.

4. In the view, locate the chart widget you want to add to the dashboard.

5. In the widget toolbar, click  to move the widget to the dashboard.

   The widget is copied to the bottom of the nDepth Dashboard.

   Click  to minimize the widget in the dashboard. To restore the widget, scroll down and click the widget title bar.

• nDepth view in the LEM console for information about each nDepth widget type