Skip to main content
Version: 6.2

Objects

An object is a Broker record that combines messages from different modules about one entity. Messages belong to one object when the values of their identity fields match under the rules of an identification configuration. To open the list of objects, go to Main Menu - Broker - Objects.

The list shows objects only of the identification configurations on which the user has read permission.

Object Card​

The object card shows information received from the modules.

Modules​

The Modules tab shows what each module reported about the object for the selected period. For example, the Incident Manager shows the object's incidents, UBA shows the risk score and anomalies, and Inventory shows asset changes.

Activity​

The Activity tab shows by hour how many messages about the object each module sent, and lists the linked objects. The number next to a linked object shows how many messages it shares with the object of the card.

Timeline​

The Timeline tab lays out over time the messages of the card's object and of the objects linked to it. The timeline shows what happened to neighboring objects before and after the message of interest.

When you select a message, the Detected sequences panel opens on the right. A sequence is a chain of messages that regularly follow one another on shared objects. For example, an anomaly of a user account on a host is followed by an incident on the same host.

Messages​

The Messages tab contains the messages about the object. The list works the same way as the journal.

The Links tab shows the link graph of the object. The number on a link line shows how many messages the two objects share.

The slider above the graph sets the depth, that is, how many steps from the card's object the graph covers. Selecting a link line opens the shared messages of that pair of objects. Selecting an object opens its card in a new browser tab.