Building Event Detail Templates

Events dragged into the Object Details Viewer display fields by default in a line-by-line fashion. This layout can be customized to emphasize or obfuscate important data fields.

Event templates can be applied to multiple events, and a single event can use multiple templates.

Event detail templates are globally visible to all Workstation users when viewing events. Users with write permissions for Workstation Templates Event Details can create, edit, or delete templates.

Note

Event detail templates are visible in the Designer to any user with read and write permissions for Templates Event Details.

Creating Event Detail Templates

Event detail templates are viewable in the Object Details Viewer.

To create an event detail template:

1. From the top of the workstation Home page, click the Designer tab.

2. In the left side drawer, click the Event Details Template icon.

3. Click the blue + icon to create a new template. A new modal popup opens.

4. Name the template.

5. Pick the event type you wish to create a template for.

6. Click Submit. The workspace to arrange event details appears.

7. Arrange the event details template as needed.

8. Click Submit to finalize the event detail template's creation.

Arranging Event Details in a Template

Event details vary based on the data ingested into Workstation. In the left panel, all fields available to the event type can be dragged into the workspace for a customizable arrangement. Fields can be emphasized or obfuscated based on their importance to a given use case, and these views can be used in event analysis.

The following rules should help guide usage of this workspace:

• At the top of the workspace, use Template Name to personalize the template in progress.
• To the right of Template Name, use Preview to view a sample of data in a modal popup.
• From the left panel, click and drag an event detail block into the workspace. A highlighted outline of the object helps determine placement.
  • Click the data event detail, and type a name to rename that field.
  • Each block dragged into a workspace uses the data field's default name.
• At the bottom right corner of any event detail block, click the resize icon to resize the block.
  • Each block can be as wide or tall as needed to accommodate any sized widget.
  • Use Preview frequently to examine templates in progress.
  • A minimum of three by three blocks is recommended for geo data and maps.
• Create as many blocks as needed.

Tip

Add one block for each field the analyst needs to see. Order is preserved, so arrange most important details accordingly.

• Click and drag blocks around the grid to reorder them.
• At the upper right of any block, click the three dots icon to open a context menu and delete the the block.

Editing Existing Templates

In the Designer tab of Workstation, users with read permissions for Templates Event Details can view Event Detail Templates. Users with write permissions can edit and delete templates, even if they were created by other users.

To edit an existing template:

1. From any workstation page or view, click the Designer tab.
2. In the left panel, click Event Details Templates.
3. At the right of any event details template, select Edit or Delete.
   1. Edit opens a working view to arrange the event details template.
   2. Delete an event details template to remove it from workstation.

Warning

All event notifications that used a deleted event details template remain, but the event details template view used in object detail viewers is removed.