Building Event Detail Templates

Events dragged into the Object Details Viewer display fields by default in a line-by-line fashion. This layout can be customized to emphasize or obfuscate important data fields.

Event templates can be applied to multiple events, and a single event can use multiple templates.

Event detail templates are globally visible to all Workstation users when viewing events. This guide assumes you are logged into your Cogynt Workstation URL with these minimum permissions:

• read permissions for Workstation Templates Event Details.
• write permissions for Workstation Templates Event Details.

Note

Event detail templates are visible in the Designer to any user with read and write permissions for Templates Event Details.

Creating Event Detail Templates

Event detail templates affect how the data points of an event are arranged in Object Details Viewer. Templates can hide or emphasize information, present data in multiple columns, and change the order of an event's details.

To create an event detail template:

1. From the top of the workstation Home page, click the Designer tab.

2. In the left side drawer, click the Event Details Template icon.

3. Click the blue + icon to create a new template. A new modal popup opens.

4. Name the template.

5. Pick the event type you wish to create a template for.

6. Click Submit. The workspace to arrange event details appears.

7. Arrange the event details template as needed.

8. Click Submit to finalize the event detail template's creation.

Arranging Event Details in a Template

Event details vary based on the data ingested into Workstation. In the left panel, all fields available to the event type can be dragged into the workspace for a customizable arrangement. Fields can be emphasized or obfuscated based on their importance to a given use case, and these views can be used in event analysis.

The following rules should help guide usage of this workspace:

• At the top of the workspace, use Template Name to personalize the template in progress. The name used will be selectable in Object Details Viewer.
• To the right of Template Name, use Preview to view a sample of data in a modal popup.
• From the left panel, click and drag an event detail block into the workspace. A highlighted outline of the object helps determine placement.
  • Each block dragged into a workspace uses the data field's default name.
  • Click the data field, and type a name to rename it.
• At the bottom right corner of any event detail block, click the resize icon to resize the block.
  • Each block can be as wide or tall as needed to accommodate any sized widget.
  • Use Preview frequently to examine templates in progress.
  • A minimum of three by three blocks is recommended for geo data and maps.
• Create as many blocks as needed.

Tip

Add one block for each field the analyst needs to see. Order is preserved, so arrange most important details accordingly.

• Drag blocks around the grid to reorder them.
• At the upper right of any block, click the three dots icon to open a context menu and delete the the block.

Editing Existing Templates

In the Designer tab of Workstation, users with read permissions for Templates Event Details can view Event Detail Templates. Users with write permissions for Templates Event Details can edit and delete templates, even if they were created by other users.

To edit an existing template:

1. From any Workstation page or view, click the Designer tab.
2. In the left panel, click Event Details Templates.
3. At the right of any event details template, select Edit or Delete.
   1. Edit opens a working view to arrange the event details template.
   2. Delete an event details template to remove it from Workstation.

Warning

When an event details template is deleted, all event notifications that used it remain but the template view used in Object Details Viewer is removed and no longer selectable.