Properties Metadata

In this screen you can add, modify, and delete metadata properties. The properties metadata enable you to rewrite how event fields will be presented and under what category they appear such as case overview – event fields and entity screen – enrichment fields. So for example, I can create a properties metadata in this screen so that all the events or enrichments fields that start with the AD_ prefix will be grouped under the Active Directory category.

Once you have created the metadata property, you can validate it following the procedure below.

To add a properties metadata:

1. Click the plus icon on the top right of the screen.
2. Add in the relevant information as follows:
   • System Name: this is the name of the raw field
   • Display Name: how you want it to display on the screen
   • Group Name: name of group/category it will appear under
   • Prefix: Used for grouping multiple fields together. Add in a prefix to group them together
   • Trim Prefix: so that the prefix does not display as part of the field name.
     Example – “AD_department” will be presented as “department” in case you defined “AD_” prefix and trimmed it
   • Is displayed: Select this checkbox to display the field on the screen
   • Is highlighted: Select this checkbox to display the field in the Highlighted section of the screen
     
3. Click Create.
   

To validate the properties metadata (without adding a Prefix):

1. Add properties metadata for a specific field without a prefix such as File Name as follows:
   
2. Navigate to the Cases screen.
3. The category File will appear in the Context Details highlighted and regular sections.
   
   

To validate the properties metadata (with a Prefix):

1. Add properties metadata for multiple fields including a VT prefix as follows:
   
2. Navigate to the Cases screen.
3. In the Context Details, click an Entity and you will be directed to the Entities screen and you will see the Category header with the values underneath.