Export Data from Synapse

There are several ways to export data from Synapse. The best option may depend on factors such as the type of data, volume of data, or whether the data needs to be in a particular format.

This document focuses on those methods likely to be most helpful for Synapse users. For programmatic access to Synapse and Synapse data, refer to the Storm API guide in the Synapse Developers Guide.

Note

Synapse also includes helper libraries to support the export and import of data in STIX format.

Export Data from Tabular Mode

When using the Research Tool in Tabular Mode, you can export any individual column or table from the data displayed in the Results Panel.

Tip

The data will be exported exactly as displayed. If you need to adjust the columns that are displayed or their order, see the section on customizing the Research Tool - Tabular Display Mode in the Customize Your Environment section of this guide.

Export All Values in a Column

You can export (copy) the full set of values in any column as either a space-separated or a newline-separated list.

  1. In the Research Tool, Tabular Mode, locate the column that you want to export in the Results Panel.

    Click the column header of the column you want to export and select copy > from the drop down menu. Select either copy all space separated or copy all newline separated, depending on the format you want for the data:

    ../../_images/export_column_01.gif

  2. Synapse will display a temporary popup (“toast”) window indicating that the values have been copied to the clipboard.

    ../../_images/export_column_02.png

  3. Paste the data from your clipboard into a new document:

    ../../_images/export_column_03.gif

Export a Subset of Values in a Column

You can export (copy) a selected set of values in any column as either a space-separated or newline-separated list.

  1. In the Research Tool, Tabular Mode, locate the data that you want to export in the Results Panel.

    Use shift-click or ctrl-click to select the specific results (rows) whose data (column value) you want to copy:

    ../../_images/export_column_part_01.gif

  2. In the Details Panel, click the property whose values you want to copy. Select copy > from the drop down menu. Select either copy all space separated or copy all newline separated, depending on the format you want for the data:

    ../../_images/export_column_part_02.gif

  3. Synapse will display a temporary popup (“toast”) window indicating that the values have been copied to the clipboard.

    ../../_images/export_column_part_03.png

  4. Paste the data from your clipboard into a new document:

    ../../_images/export_column_part_04.gif

Export a Table

You can export any table into a CSV file.

  1. In the Research Tool, Tabular Mode, locate the table that you want to export in the Results Panel.

    Click the hamburger menu next to the table header and select Export CSV from the drop down menu:

    ../../_images/export_table_01.gif

  2. Synapse will display a temporary popup (“toast”) window indicating that the CSV file is being generated:

    ../../_images/export_table_02.png

  3. Choose a location to save the exported CSV file:

    ../../_images/export_table_03.gif

Export Data from Force Graph Mode

When using the Research Tool in Force Graph Mode, you can export any force graph as an image (PNG) file.

  1. In the Research Tool, Force Graph Mode, display the force graph that you want to export:

    ../../_images/export_force_graph_01.png

  2. From the main Force Graph Mode hamburger menu, select Export as PNG:

    ../../_images/export_force_graph_02.png

  3. You will see a popup window prompting you to download the image. Click the Click to download link:

    ../../_images/export_force_graph_03.png

  4. Choose a location to save the exported PNG file:

    ../../_images/export_force_graph_04.gif

Export Data from Statistics Mode

When using the Research Tool in Statistics Mode, you can export the data used to generate a particular bar chart or sunburst chart as a CSV file.

Tip

This process does not export the chart as an image, but will allow you to generate similar charts or graphs from a spreadsheet application using the exported CSV data.

  1. In the Research Tool, Statistics Mode, locate the graph whose data you want to export. From the graph’s hamburger menu, select Export CSV:

    ../../_images/export_stats_01.gif

  2. Choose a location to save the exported CSV file:

    ../../_images/export_stats_02.gif

Export Data from Geospatial Mode

When using the Research Tool in Geospatial Mode, you can export a map view as an image (PNG) file.

  1. In the Research Tool, Geospatial Mode, display the map image that you want to export:

    ../../_images/export_geo_01.png

  2. From the main Geospatial Mode hamburger menu, select Export as PNG:

    ../../_images/export_geo_02.png

  3. You will see a popup window prompting you to download the image. Click the Click to download link:

    ../../_images/export_geo_03.png

  4. Choose a location to save the exported PNG file:

    ../../_images/export_geo_04.gif

Export Data as a Nodes File

Synapse allows you to export a subset of data (nodes, edges, and / or tags) in native Synapse format (called a “nodes file” due to its .nodes file extension). The file can then be imported directly into another instance of Synapse.

  1. In the Research Tool, specify a Storm query that defines the set of nodes (the subgraph) that you want to export:

    ../../_images/export_nodes_01.png

    Tip

    You do not need to run the Storm query that you enter in the query bar (running the query will attempt to display the query results in the Results Panel, which is impractical for large exports). Synapse will execute the query in the background when it generates the file for export.

    For sizeable and / or detailed subgraphs, the Storm query required to explicitly lift and pivot to all of the nodes you want to include can quickly become complex. An easy way to “define” the set of nodes to export is to simply tag all of the nodes you want to include, e.g., #my.export. You can then specify that tag in the Storm query bar to generate and export the nodes file, and remove the tag when you are done.

    Note that when exporting light edges, you do not need to explicitly specify the edge(s) themselves. If you export any nodes that are linked by a light edge, the light edge is automatically included in your nodes file.

  2. From the Storm Query Bar menu (meatball menu), select Export nodes file:

    ../../_images/export_nodes_02.png

  3. In the Export Query to Nodes File dialog, in the Tag inclusion field, specify the tag(s) you want to include on the nodes you are exporting. Click the Export button to generate the nodes file:

    ../../_images/export_nodes_03.gif

    Tip

    Recall that hierarchical tags consist of individual tags at each level of the hierarchy; so the tag foo.bar.baz actually consists of the tags foo, foo.bar, and foo.bar.baz. Specifying a higher level tag in the tag inclusion field will also export all tags below that tag in the hierarchy. So specifying the tag foo will also export all sub-tags below foo (the equivalent of foo.*).

    Note that the tag inclusion field does not support tag glob format (e.g., foo.*).

    To include all tags on all nodes in your export, leave the field empty.

    To not include any tags in your export, enter a space in the field.

  4. Choose a location to save the nodes file:

    ../../_images/export_nodes_04.gif

    Note

    Depending on the amount of data you are exporting, it may take Synapse some time to generate the nodes file. The “save file” dialog box will not appear until the nodes file has been generated and is ready to be saved.

Download a File from Synapse

You can download any file from Synapse’s axon storage and save it to disk.

Tip

Synapse’s data model can represent a file (as a file:bytes node) even if Synapse does not have a copy of the actual file. The presence of a file:bytes node in Synapse does not necessarily mean that the corresponding file is available in Synapse’s axon storage.

  1. In the Research Tool, locate the file that you want to download. Right-click the file and select download file:bytes from the context menu:

    ../../_images/download_file_01.gif

    Tip

    You can select multiple files for download using shift-click or ctrl-click.

    Alternatively, you can download the file(s) by clicking the download icon in the Details Panel:

    ../../_images/download_file_01a.gif

  2. If you wish to wrap the file inside of a ZIP archive, toggle the Archive Files switch to the ON position:

    ../../_images/download_file_02.gif

    Tip

    When downloading multiple files, the files will always be wrapped inside a ZIP archive.

  3. If you wish to password-protect your ZIP archive, the Archive Password input box will be enabled after setting the Archive Files switch to the ON position

    ../../_images/download_file_03.gif

    Tip

    Your administrator may have set a mandatory password for all downloaded files. In that case your file will always be downloaded as a password protected ZIP archive, and you should contact your administrator for the password.

  4. Click the Download button to download the file:

    ../../_images/download_file_04.gif

  5. Choose a location to save the downloaded file:

    ../../_images/download_file_05.gif

    By default, the file will be saved using its file:bytes:name value, if present. If a file with the same name already exists in the download location, Synapse will deconflict the names by adding a numerical extension (e.g., if svchost.exe already exists, Synapse will save a file with the same name as svchost.exe_1).

    If the file:bytes node does not have a :name value, the name will default to the file’s SHA256 hash.

Warning

Synapse’s axon storage may contain both non-malicious (documents, reports) and malicious (malware sample) files, depending on how you are using Synapse for analysis. Synapse does not include any mechanisms to detect or distinguish “safe” files from potentially “risky” ones.

Users download files from Synapse at their own risk.

Export a Story from Synapse

To export a Story from Synapse, see Export a Story as a PDF in the Stories Tool documentation.