Using the Global Events Stream

Events ingested into Workstation become a part of the Global Events Stream. This stream of data is lively and will grow or shrink when new data and information is processed or deleted in Authoring/HCEP. The stream of events may contain many different types of events, such as:

• Fraudulent Transactions
• IP Theft
• Suspicious Accounts

There is one global stream of events which any view subscribes to; however, each view may also be configured to display only a portion of the stream of events by utilizing search or filtering.

Applying Filters to the Global Event Stream

The global events stream can be filtered down using the Global Search Facets to determine which projects, event types, or data fields appear in the events stream of a view.

Note

Search facets applied to the events stream primarily affect the Events Stream widget on the current view, but can also affect data displayed in the Map and Link Analysis widgets as well if they are explicitly connected to the stream of events.

Any search facets used only apply to the current view. Users can have multiple views in which each might have a different set of filters on the stream of events.

To determine events stream conditions:

1. From an open view in the left drawer menu, locate the Events Stream icon.
2. Click Events Stream... to open the events stream drawer.
3. At the top of the Events Stream drawer, three tabs exist:
   • Projects filters events across one or multiple projects.
     • Click an event type to select or deselect it.
       • The leftmost icon of a deselected event is a closed eye.
       • The leftmost icon of a selected event is an open eye.
     • Toggle the All Projects button to rapidly select or deselect all event types.
   • Type filters by event link analysis type (none, entity, linkage).
   • Data Fields filters any combination of data fields for event types. Apply data field conditions when filtering by data fields.
4. Click Apply Filters to apply the designated filters, Reset All Filters to return to the default state, or Cancel to discard the filters.

Data Field Conditions

Data field conditions add some logic to help with matching data within specific fields. The following table outlines various conditions that can be applied as conditional filters in the search facet data fields tab:

Data Type	Conditionals
String	Contains, equals (case insensitive), exists
Date Time	Between
Integer	Equal to, not equal to, greater than, less than, greater than or equal to, less than or equal to, between, not between
Float	Equal to, not equal to, greater than, less than, greater than or equal to, less than or equal to, between, not between
UUID	Contains, equals (case insensitive), exists
Geo	Exists
Boolean	True, False, Exists

To add conditions to data field search facets:

1. At the right of a data field entity, click the + button to open data field conditions.
2. Click the dropdown conditional menu to select a condition.
3. Enter a search term if applicable.
4. Click the checkmark to save the data field condition, or the X button to discard it.

Risk Scoring and Event Notifications

The events stream is most useful to view events in the system. For a more explicit means of identifying events with a high risk score, Cogility suggests configuring event notifications.