Advanced Settings for Workstation Use

The optional Workstation settings described here can improve the efficiency of collection analysis.

If your data contains a risk score, we suggest configuring event notifications for a more explicit means of identifying high-risk events.

Create tags for notifications and collections that you can use to color-code, label, and filter by in several widgets.

Assumptions

This guide assumes you have already gone through the Workstation Setup Guide, and logged into your Cogynt Workstation URL with the following minimum permissions:

• write permissions for Workstation: Ingest.
• write permissions for Workstation: Notification Settings.

Working With Event Notifications

Event notifications draw attention to particular system actions, events, or other occurrences that users should know about. Each event notification is tied to a specific event_type produced by a pattern in Authoring. An event can also contain a risk score.

Event notifications can:

• Utilize system and notification tags for a custom status and labelling system.
• Have a priority.
• Have an assigned user.
• Issue an alert to the assigned user in Workstation when the event notification is updated.
• Be archived or dismissed.

Event notifications also let users quickly view and analyze the underlying events that trigger them.

Creating Event Notification Settings

Event notifications are triggered depending on the configurations set when a notification setting is created. Refer to the event notifications document for an understanding of how these settings impact workflows.

To create a notifications setting:

1. Click the Admin tab.
2. From the right side Notification Settings column, click the blue + icon. A modal popup opens containing the settings for this event notification.
3. Select the Event Type to associate with the event notification.
4. Select a Title from the list of available data fields from the event type. Titles can be edited later.
5. Set the event notification's Visibility within the admin screen.
   • If the notification has a Visibility setting of public:
     • All users can see unique event notifications that a public setting triggers.
     • All users with write permissions can edit the setting.
     • All users with read permissions for Admin: Notification Settings can view the setting.
   • If a notification has a Visibility setting of private:
     • Only the user who created the Notification Setting can view and edit it.
     • Other users can see event notifications produced by this setting if they are manually assigned to it.
6. Optionally, in the Assign To field, choose whether there is a default user to receive any event notifications produced by this setting.
   • No One: No user receives event notifications triggered by this setting by default. The unique notifications can be assigned to users from the event notifications widget.
   • If a user is assigned: Any event notification or update triggered by this setting is automatically assigned to this user and triggers a system notification for them.
7. Establish a risk threshold using the Risk Range slider. Event notifications are issued when the risk score falls within the range defined.

Tip

A more specific Risk Range helps avoid spam notifications and cut noise. Adjust the slider’s upper and lower values within the range of 0 to 100 with the highest precision possible to home in on notifications that meet those defined risk thresholds.

8. Assign an optional Notification Tag to filter for and color code specific event notifications.
9. Optionally, select the Process notifications for events already ingested checkbox if you wish for event notifications to be created for the events that have already been ingested into Workstation. If unchecked, this notification setting only starts processing notifications for new events or updates to events from the time the notification setting is created. This option is unchecked by default.
10. Click Submit to create the event notification, or Cancel to discard changes.

Note

Any unique event notification can be reassigned regardless of whether its notification setting is public or private.

Managing Event Notifications

The three dot menu icon (⋮) on the right side of any event notification opens a number of settings, including:

• Update a notification.
• Delete a notification.

Updating Event Notifications

Event notifications can be updated when changes are needed to any attributes.

To update an event notification:

1. From the event notification's three dot menu icon (⋮), click Update to edit any of the the following fields:
   1. Title
   2. Visibility
   3. Assigned to
   4. Risk Range
   5. Tag
2. Click Submit to save the adjusted settings, or Cancel to discard the changes.

Deleting Event Notifications

Individual event notifications cannot be deleted by the the user, although they can be archived or dismissed so that they do not appear on the notification-based widgets.

System-Triggered Deletion of Single Event Notifications

It is possible for the system to automatically delete a single event notification under two scenarios:

1. The event that triggered a notification has changed in risk score so that it no longer satisfies the notification setting risk threshold.
2. The event tied to the event notification was designated to be deleted from an Authoring pattern.

Deleting All Notifications Triggered from Notification Settings

When a notification setting is deleted, any event notifications triggered by the setting are also deleted.

To delete a notification setting, from the event notification setting three dot menu icon (⋮), click Delete.

Note

When users delete a notification setting, all associated event notifications are also deleted, but the underlying events are still viewable in Workstation via the Events Stream.

Managing Tags

Tags allow users to define custom workflows and color coding for event notifications and collections. They also enable filtering to be performed on large sets of notifications and collections.

Tags come in three varieties:

1. Notification tags are assigned only to event notifications, one tag per notification.
2. Collection tags are assigned only to collections, one tag per collection.
3. System tags are versatile, assignable to both collections and notifications.

Each of these tag varieties has its own column in the Designer tab.

Creating Tags

New tags can be created as needed to help keep your data organized.

To create new tags:

1. Click the Designer tab.
2. Locate the column for the type of tag to create. The following tags are possible:
   1. Notification tags for event notifications, one tag per notification.
   2. Collection tags for collections, one tag per collection.
   3. System tags for collections and notifications, multiple tags possible on a single entity.
3. Click the blue + button to create a new tag row. The new tag uses a default name upon creation.
4. Click the pencil icon ✎ for the newly created tag, and enter a name for it.
5. Click the color palette icon to customize the tag's color.
6. When finished, click the checkmark to save your changes, or the X to discard them.

Editing Tags

Tags can be edited to correct errors made during their creation, or to change the tags as needed.

To edit a tag:

1. Click the pencil icon ✎ beside the tag.
2. Enter a new name for the tag if necessary.
3. Select a new color for the tag if necessary.
4. When finished, click the checkmark to save your changes, or the X to discard them.

Deleting Tags

If a tag is no longer needed, or was created by mistake, it can be removed.

To the right of any tag, click the trash can icon 🗑 to delete it.

Note

Upon deleting a tag, the system prompts the user to select another tag to reassign to all collections and/or notifications affected by deletion.

Sorting Tags

All tags can be reordered by clicking and dragging up or down, which changes the tag sort order and assigns each tag a priority score.

To sort tags:

1. At the top Workstation navigation, click the Designer tab.
2. Hover the mouse cursor over any tag. The cursor changes to a hand icon.
3. Click and drag the tag to its new location.

The sort order of tags is optional, but can be utilized in several widgets:

• Notifications widget: Can sort event notifications based on notification tag order.
• Notifications Explorer widget: Can sort event notifications based on notification tag order.
• Collections widget: Sorts the collection by the collection tag order.