Customize Your Environment

Optic allows you to customize your user environment to best support your analysis tasks. You can even create and manage separate user environments - known as Workspaces - for different projects or different kinds of research.

You configure some customizations to your Workspace through the Workspaces Tool. Other settings are automatically saved to your Workspace as you work. These include:

  • Your Research Tool - Tabular Mode columns layout

  • Your Storm query bar mode (e.g., Lookup, Storm, etc.)

  • The current state of each display mode (e.g., Tabular, Force Graph, etc.)

  • Your query history in the Research and Console Tools for each query mode

Workspaces Tool

The Workspaces Tool can be accessed from the Optic Toolbar:

../../_images/icon_workspaces.png

Create a new Workspace

  1. In the Workspaces Tool, select the WORKSPACES tab.

    ../../_images/workspaces_tab.png
  2. Click the + New Workspace button.

    ../../_images/new_workspace.png
  3. In the New Workspace dialog, in the Name field, enter a name for your Workspace.

    Click the Save button to create the Workspace.

    ../../_images/new_workspace.gif

    Tip

    The new Workspace will be a “blank” Workspace with no customizations set.

Copy an existing Workspace

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the Workspace you wish to copy.

    Click the hamburger menu next to the Workspace name and choose Copy Workspace.

    ../../_images/copy_workspace_01.gif
  2. In the New Workspace dialog, optionally edit the name of the new Workspace.

    Click the Save button to save the new Workspace.

    ../../_images/copy_workspace_02.gif

    Tip

    The new Workspace will preserve all the settings of the Workspace it was copied from and can be further customized as needed.

Delete a Workspace

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the Workspace you wish to delete.

    Click the hamburger menu next to the Workspace name and choose Delete.

    ../../_images/delete_workspace_01.gif
  2. You will see a confirmation dialog. Click Confirm to delete the Workspace.

    ../../_images/delete_workspace_02.png

    Note

    It is not possible to delete the original Default Workspace present for each user. You also cannot delete a Workspace if it is currently the active Workspace (in the Workspace Selector in the Top Bar). The Delete menu option will be grayed out in each case.

Create (set) a Global Default Workspace

A Global Default Workspace can be used to customize a Workspace and publish those customizations for other users.

Note

You must have Admin privileges to create (set) a Workspace as a Global Default.

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the Workspace you wish to make the Global Default.

    Customize the Workspace according to your needs.

    Click the hamburger menu next to the Workspace name and choose Set as Global Default.

    The display name for the Workspace will change to italics and will have [global default] appended to it.

    ../../_images/global_default_set_01.gif

    Note

    Only one Global Default Workspace can be set at a time. If you set a new Global Default while one already exists, the existing Global Default is automatically unset.

  2. Other users will now see this as an available Workspace in their Workspaces Tool. However, the Workspace is read-only - users can select and use the Workspace but cannot make any other changes or customizations.

    The recommended practice is for users to create a copy of the Global Default (see Copy an existing Workspace) that they can use and further modify if needed.

    Tip

    An admin can make additional changes to the master copy of the designated Global Default Workspace, which will be propagated to the read-only copies visible to other users. However, changes are not propagated to any copies that users have already made from the read-only original.

Remove (unset) a Global Default Workspace

Note

You must have Admin privileges to remove (unset) a Workspace as a Global Default.

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the current Global Default Workspace.

    Click the hamburger menu next to the Workspace name and choose Unset Global Default.

    The display name for the Workspace will change back to normal.

    ../../_images/global_default_unset_01.gif
  2. Users will no longer see a copy of this Workspace in their Workspaces Tool. Any copies of the Workspace that users previously created will remain available to them.

Set your tag color preferences

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the Workspace you wish to customize.

    ../../_images/tag_colors_01.gif
  2. In the Workspace Preferences panel, select the TAG COLORS tab.

    ../../_images/tag_colors_02.png
  3. In the Add Tag Color input form, in the tag (foo.bar) field, enter the name of the tag you want to colorize (such as my.tag). You can also specify a tag glob pattern using the wildcard / asterisk (*) character (e.g., my.tag.*.malware).

    In the color (green) field, enter the name of the HTML color you want to use for the tag color.

    You can also click the colored square next to the color field and specify any of the following for the tag color:

    • RGB values

    • HSL values

    • Hex value

    Or, you can click a location on the color map to auto-fill the values for your selected color.

    Click the + Add Color button to add the tag color rule.

    ../../_images/tag_colors_03.gif
  4. Once added, the new tag color rule will appear in the TAG COLORS list view.

    ../../_images/tag_colors_04.png

Tip

Once a tag color rule is set, you cannot change the tag name / pattern or the color value. To change these settings you must delete the tag color rule and create a new one.

  1. To change the order of your tag rules, click and hold the tag rule you want to move and drag it to its new location.

    ../../_images/tag_colors_05.gif

    Note

    If a node has more than one tag with an associated tag color rule, the rule highest in the TAG COLORS list view will take precedence.

Change the default number of results displayed

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the Workspace you wish to customize.

    ../../_images/query_prefs_01.gif
  2. In the Workspace Preferences panel, select the RESEARCH QUERY PREFERENCES tab.

    Double-click the value you want to change. Enter the new value and press Enter to save the value.

    ../../_images/query_prefs_02.gif

    Tip

    The load increment is the number of results that will be returned before Synapse will pause and prompt you to continue loading additional results.

    The display max is the maximum number of results Synapse will display in the specified display mode.

Create a custom Node Action

  1. In the Workspaces Tool, select the WORKSPACES tab. From the Workspaces list view, select the Workspace you wish to customize.

    ../../_images/node_action_01.gif
  2. In the Workspace Preferences panel, select the NODE ACTIONS tab.

../../_images/node_action_02.png
  1. In the Add Node Action input form, in the name field, specify a name for your Node Action.

    In the query field, enter the Storm that the Node Action should run.

    In the formtypes field, enter the name of the form (or forms) the Node Action should apply to. (Leave this field blank if the Node Action should apply to / be available for all forms.)

    By default, your Node Action will run in the background, and the results displayed in Synapse willl not be updated. If you want Synapse to return the results of running the Node Action, toggle the Render Nodes yielded from Action? switch to ON.

    Click the + Add Action button to create the Node Action.

    ../../_images/node_action_03.gif
  2. The new Node Action will appear on the NODE ACTIONS tab.

    ../../_images/node_action_04.png

    When using this Workspace in the Research Tool, the Node Action will be available from your right-click context menu (under actions >) for the forms you specified (or for all forms, if you did not specify any).

    Tip

    Node Actions cannot be modified once they are created. If you need to change a Node Action, you must delete the original Node Action and create a new one.

Research Tool - Tabular Mode

In Tabular mode, Synapse displays each form’s primary property in the Results Panel by default. You can customize the data Synapse displays for each form, including:

  • properties

  • tags

  • tag timestamps

  • properties from related / adjacent nodes

Your column layouts are automatically saved as part of your active Workspace.

Display selected properties in columns

There are two primary ways to configure property columns: using the Details Panel and using the Edit Columns dialog.

Note

When adding a new column, the column is always inserted as the right-most column. See Change the order of my columns to reorder your columns.

Add or remove a property using the Details Panel

Configuring properties using the Details Panel provides a fast and easy way to add or remove columns.

  1. In the Results Panel, select a node for the form you want to configure.

    ../../_images/add_remove_details_panel_01.gif
  2. View the node’s properties in the Details Panel.

    Toggle the dot to the left of any property name to add or remove it from the display:

    • Toggle the dot to green to add it to the Results Panel.

    • Toggle the dot to gray to remove it from the Results Panel.

    ../../_images/add_remove_details_panel_02.gif

    Tip

    In the Details Panel, use the NODE tab to:

    • toggle the display of the form’s primary property;

    • toggle the display of any property that is set for your selected node; or

    • toggle the display of the timestamps for any tag on the node.

    Use the ALL PROPS tab to:

    • toggle the display of any property for that form, even if the property is not currently set.

Add a property using the Edit Columns dialog

The Edit Columns dialog provides greater flexibility and more options for configuring your columns.

  1. In the Results Panel, click the hamburger menu next to the name of the form you want to configure and choose Edit Columns from the menu.

    ../../_images/add_edit_cols_01.gif
  2. In the Edit Table Columns dialog, click the + Add Column button.

    ../../_images/add_edit_cols_02.png
  3. In the Add Table Column dialog, from the Column Type dropdown list, select Property.

    Select the property you wish to add from the dropdown list of available properties for that form.

    Click the Save button to add the property and return to the Edit Table Columns dialog.

    ../../_images/add_edit_cols_03.gif
  4. The new property will be visible in the Edit Table Columns dialog. Click the X to close the dialog.

    ../../_images/add_edit_cols_04.gif

Remove a property using the Edit Columns dialog

  1. In the Results Panel, click the hamburger menu next to the name of the form you want to configure and choose Edit Columns from the menu.

    ../../_images/remove_edit_cols_01.gif
  2. In the Edit Table Columns dialog, click the trash can icon next to the property you wish to remove.

    Click the X to close the Edit Table Columns dialog.

    ../../_images/remove_edit_cols_02.gif

    Tip

    Use this process to remove any type of column (e.g., property, tag, tag glob, or embed).

    To quickly remove a column, you can also left-click the column header in the Research Tool and select hide X from the column header menu.

Display tag timestamps as columns

This process adds tag timestamps to a single form that you specify. To add tag timestamps to all forms that have the tag, see Display a specific property, tag timestamp, or tag for all forms.

  1. In the Results Panel, click the hamburger menu next to the name of the form you want to configure and choose Edit Columns from the menu.

    ../../_images/add_tag_timestamp_01.gif
  2. In the Edit Table Columns dialog, click the + Add Column button.

    ../../_images/add_tag_timestamp_02.png
  3. In the Add Table Column dialog, from the Column Type dropdown list, select Tag.

    Enter the name of the specific tag whose timestamps you want to add as columns.

    Click the Save button to add the timestamps and return to the Edit Table Columns dialog.

    ../../_images/add_tag_timestamp_03.gif
  4. The new tag whose timestamps will be displayed will be visible in the Edit Table Columns dialog. Click the X to close the dialog.

    ../../_images/add_tag_timestamp_04.gif

    Tip

    You can only display timestamps associated with a single tag. You cannot use wildcard syntax to specify “timestamps for any tag that matches this pattern”.

    You can also add tag timestamps by toggling the dot next to the tag in the Details Panel.

Display tags in a column

This process adds a tag (or tags) to a single form that you specify. To add tags to all forms that have the tag, see Display a specific property, tag timestamp, or tag for all forms.

  1. In the Results Panel, click the hamburger menu next to the name of the form you want to configure and choose Edit Columns from the menu.

    ../../_images/add_tag_01.gif
  2. In the Edit Table Columns dialog, click the + Add Column button.

    ../../_images/add_tag_02.png
  3. In the Add Table Column dialog, from the Column Type dropdown list, select Tag glob.

    Enter the name (or pattern, using the wildcard / asterisk) for the tag(s) you want to display.

    Click the Save button to add the tag(s) and return to the Edit Table Columns dialog.

    ../../_images/add_tag_03.gif
  4. The new tag (or tag glob) will be visible in the Edit Table Columns dialog. Click the X to close the dialog.

    ../../_images/add_tag_04.gif

Display a property from a “nearby” node in a column (embed column)

An embed column allows you to display a property from an adjacent node in the columns for a given form. This can provide additional context for the displayed node without having to explicitly pivot (or explore) to view the adjacent node.

You must use Storm’s embedded property syntax to specify the embedded property to add.

  1. In the Results Panel, click the hamburger menu next to the name of the form you want to configure and choose Edit Columns from the menu.

    ../../_images/add_embed_01.gif
  2. In the Edit Table Columns dialog, click the + Add Column button.

    ../../_images/add_embed_02.png
  3. In the Add Table Column dialog, from the Column Type dropdown list, select Embed.

    Enter the embedded property syntax expression that references the adjacent property you want to display.

    Click the Save button to add the embedded property and return to the Edit Table Columns dialog.

    ../../_images/add_embed_03.gif
  4. The embed column will be visible in the Edit Table Columns dialog. Click the X to close the dialog.

    ../../_images/add_embed_04.gif

    Note

    You will need to refresh your Results Panel in order to populate the values in the embed column.

    • If your results were obtained from a Storm query, re-run the query.

    • If your results were obtained by using the Explore button to navigate, go back one step in your breadcrumbs and re-navigate to the results.

Display a specific property, tag timestamp, or tag for all forms

This process allows you to specify that a property, tag, or tag timestamps should be displayed for any / all forms where the item is present.

1. In Tabular mode, click the display mode hamburger menu (to the far right of the display mode selector, next to the Scroll to Form dropdown) and choose Edit global columns.

../../_images/add_global_01.gif
  1. In the Edit Table Columns (global) dialog, click the + Add Column button.

    ../../_images/add_global_02.png
  2. In the Add Table Column (global) dialog, from the Column Type dropdown list, select the type of column you wish to add:

    Follow the relevant instructions under the links above to configure the column.

    Tip

    If you are adding a property, only universal properties are present across all forms, so you can only select .seen or .created when specifying a global property column.

Use line wrapping to display long property or tag values

  1. In the Results Panel, click the hamburger menu next to the name of the form you want to configure and choose Edit Columns from the menu.

    ../../_images/line_wrap_01.gif
  2. In the Edit Table Columns dialog, toggle the Linewrap switch to the ON position for the column whose values you want to wrap.

    Click the X to close the Edit Table Columns dialog.

    ../../_images/line_wrap_02.gif
  3. The specified column will now wrap based on the column width.

    ../../_images/line_wrap_03.png

Change the order of my columns

  1. In the Results Panel, click the hamburger menu next to the name of the form whose columns you want to configure and choose Edit Columns from the menu.

    ../../_images/reorder_columns_01.gif
  2. In the Edit Table Columns dialog, click and hold the column you want to reorder and drag it to the desired position.

    Click the X to close the Edit Table Columns dialog.

    ../../_images/reorder_columns_02.gif

Reset columns to their original settings

  1. In the Results Panel, click the hamburger menu next to the name of the form whose columns you want to reset and choose Reset all columns from the menu.

    ../../_images/reset_columns_01.gif

    This returns the form to its default settings (i.e., only the form’s primary property is displayed).

    Tip

    Choosing Reset tag columns will reset (remove) any tag timestamp columns.