Appendix B: Dashboard analytics

Nuix Investigate provides a variety of powerful analytics based visualizations that enable investigators to drill deeper into case evidence to see new connections that a flat view of the data cannot provide. The Open Analytics menu item displays the available analytics that can be used to view the current result set. Analytics are available from all views.

When in the Grid, Review, or Gallery Views, analytics opens in their own windows and updates as the result set changes. If an analytic is opened within the Dashboard View, the analytic is added to the current dashboard perspective. The Dashboard View allows investigators to drill into an analytic of interest and see how its results correlate with those of other analytics.

Each analytic provides several customizations that can be configured to fine-tune the analytic. Clicking the Analytic Management icon displays all options associated with a particular analytic.

If analytics are opened in external windows, expand the Open analytics in new window menu icon and select View open analytics to bring all open windows to the foreground.

In most instances, configuration options cannot be left blank.

Breakout

The Breakout analytic displays different item categories along with the totals for each category. The categories are derived from predefined Nuix profiles. To create a custom profile for use with the Breakout analytic, see Create custom analytics.

Note: To see dashboard profiles, you must have the User folders location property set to the correct location in the Nuix Configuration Utility. See your administrator for more information.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Profile

Select a profile to apply.

Icon size

Change the size of icons used within the analytic.

Entity

Show results based on the selected entity.

Filtered by

Based on selected Entity, choose a filter to apply to the results.

Display type

Select the type of item information to display.

Click direct to results

When enabled, clicking within the analytic changes the current effective query and displays the new result set within the view specified in the JSON query. If no view is specified, it defaults to the Grid view.

When switched off, clicking within the analytic changes the current effective query and refreshes the view to reflect the new query.‎

Breakout report

To generate a PDF report that contains a table representation of the data contained within the Breakout analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Choose any additional items to include with the report:

Option

Description

Detailed data tables

Select this option to include a second table within the report that contains all queries used to generate results for the analytic.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Case summary

The Case Summary analytic shows a chart representation of the contents of the result set based on a predefined Nuix profile. To create a custom profile for use with the Case Summary analytic, see Create custom analytics.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Profile

Select a profile to apply.

Display type

Select the type of item information to display.

Chart type

Choose the type of chart to display results in.

Show zero values

Select this check box to show categories that do not contain any results.

Click direct to results

When enabled, clicking within the analytic changes the current effective query and displays the new result set within the view specified in the JSON query. If no view is specified, it defaults to the Grid view.

When switched off, clicking within the analytic changes the current effective query and refreshes the view to reflect the new query.
 

Case summary report

To generate a PDF report from this analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that lists the types of content found within the case and details for each type.

Visualization image PNG

This option includes a copy of the Case Summary visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Detailed data tables

Select this option to include a second table within the report that contains all queries used to generate results for the analytic.

Visualization image PNG

Generate the Case Summary visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Date Range

The Date Range analytic provides a graphical representation of the results based on a specified period. Highlight a portion of the timeline to zoom in and view only the results from that period. To update the effective query within the case to include only the items that are included within the specified time period, click Update Query located beneath the analytic. Alternatively, select the Auto update query check box to have the effective query updated every time the date range is changed.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration Option

Description

View scoping query

Select to view the query used to generate the analytic.

Display type

Select the type of item information to display within the graph.

Date type

Choose the file attribute date type to use in the analytic.

Slider start date

Select the analytics starting date.

Slider end date

Select the analytics ending date.

Date range report

To generate a PDF report from this analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that lists the number of items that occur within the selected date range.

Visualization image

This option includes a copy of the Data Range visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Detailed data tables

Select this option to include a second table within the report that contains specific details for the items that exist beyond the selected date range.

Visualization image PNG

Generate the Date Range visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Date trending

The Date Trending analytic uses the dates associated with items to provide a graphical representation of the results. The graph can be sorted by item date, accessed date, created date, or modified date.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Entity

Show results based on the selected entity.

Filtered by

Based on selected Entity, choose a filter to apply to the results.

Display type

Select the type of item information to display.

Chart type

Choose the type of chart to display results in.

Date type

Select a date type to use in the analytic.

Number to show

Select the number of top entities to display within the analytic.

Date trending report

To generate a PDF report from this analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that lists the number of items that occur per year based on the Data Type selected for the analytic.

Visualization image

This option includes a copy of the Date Trending visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Visualization image PNG

Generate the Date Range visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Link analysis

The Link Analysis analytic allows you to analyze common elements across two or more nodes to find links and patterns between individual pieces of evidence. Hovering over individual links displays the details of any common attributes that exist between two nodes.

The following options are available within the view.

Option

Description

Open network filtering controls.

Pause the diagram, enabling the nodes to be manually positioned.

Increase node font size.

Decrease node font size.

Toggle count-based relative options.

 

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Include unique attributes for each link

Select to display the number of unique, non-related, attributes contributed by each node type. Selecting this may decrease performance.

Named entities

Define any Named Entities to include in the link analysis, including custom named entities.

Custom metadata

Select a custom metadata profile to apply to the analytic.

Other

Choose any other metadata to include in the analytic.

Node type

Select the value to represent nodes within the analytic.

Filtered by

Based on the Node Type selected, choose an option to further filter results.

Max items per node

The maximum number of items included in the link analysis per node.

Min common attribute occurrences

The minimum number of common attributes required to be included in the visualization.

Max common attribute occurrences

The maximum number of common attributes permitted to be included in the visualization.

Note: If a user does not have access to top level items through item security, selecting the Evidence Container Node Type results in zero nodes being displayed. Granting the user access to top level items via item security resolves this issue. For more information on item security, see the section on Creating case folders and item security within the Nuix Investigate Configuration Guide.

Link analysis report

To generate a PDF report from this analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that details the type and number of common attributes that exist between each node.

Visualization image

This option includes a copy of the Link Analysis visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Detailed data tables

Select this option to include a second table within the report that contains specific details for each common attribute that exists between each node.

Visualization image PNG

Generate the Link Analysis visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Location

The Location analytic displays items on a map based on the geolocation metadata associated with an item.

For the Location analytic to work properly, the map tile server for offline maps and Google maps information must be set up in the Configuration Utility - Investigate by an administrator:

The Map tile server URL property must be set up to use offline maps that are installed on your system. Offline maps work even if there is no internet available.

The Enable Google location analytics property must be set to True to use Google maps.

When the Location analytic is called, offline maps is utilized by default. If offline maps properties are not set up or otherwise unavailable, a warning message indicates that Google maps is used if the internet is available. If neither offline maps or Google maps are set up, or if offline maps is not available and there is no internet, the location analytic does not work.

Tip: The Location analytic can interpret Geolocation information from Evidence Metadata or Custom Metadata that has been formatted using the case-sensitive field name’s Latitude and Longitude in conjunction with float values.

Note: While navigating the map within the Location analytic, results are displayed for all items in the case that include geolocation data, even if the effective query has been scoped to only return items within a specific latitude and longitude.

As the map is navigated, items that include geolocation data become visible.

Zoom in or out to change the level of detail that is presented.

Click the Full-screen icon to see the map in full screen.

Toggle the Data type icon between street and satellite data (if available).

Items with location data are indicated with circles with a number indicating the number of items inside. The larger the number, the bigger the circle. A single item is indicated by a Location Picture 77 icon.

To update the effective query within the case to include only the items that are visible within the current view of the map, click Update Query located beneath the analytic. Alternatively, select the Auto update query check box to have the effective query updated every time the map is altered.

Whether using offline maps or Google maps, you can switch between map and satellite modes.

Location report

To generate a PDF report that lists all items that contain geo-location data, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that lists the types of content found within the case and details for each type.

Visualization image PNG

This option includes a copy of the Case Summary visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Visualization image PNG

Generate the Case Summary visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Named entities

The Named Entities analytic displays an item count for all named entities, including custom named entities, based on the named entity type selected.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Named entity

Choose the Named Entity to display within the analytic.

Max returned entities

Choose the maximum number of Named Entities to include in the analytic.

Named entities report

To generate a PDF report that lists the number of each specified Named Entity found within the result set, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Optional: Choose whether to generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Pivot

The Pivot analytic allows you to compare the relationships between two elements within the selected data set.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

View

Select the first data type to view.

Filtered by

Choose a filter to apply to the first data type.

By

Select the second data type.

Filtered by

Choose a filter to apply to the second data type.

Chart type

Choose the type of chart to display results in.

 

Pivot report

To generate a PDF report from this analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that details the two items being compared and the number of items in common.

Visualization image

This option includes a copy of the Pivot visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Visualization image PNG

Generate the Date Range visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

 

Timeline

The Timeline analytic takes the result set and plots it in sequence on a timeline. Use the Expand and Contract Timeline buttons to narrow the results between a specified time frame.

When an item is selected from the timeline, Item details including the name, content (if available for display) and the date/time of creation are displayed. Navigate through the timeline using the Next and Previous arrows on either side of the analytic.

Note: The timeline analytic can only be used with result sets less than 200 items.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Date type

Select a date type to use in the analytic.

Timeline report

To generate a PDF report containing the timeline results in a table format, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Optional: Choose whether to generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Top types

The Top Types analytic shows a chart of the top types that exist within a selected entity. Hovering over an area of the chart displays details for that section.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration Option

Description

View scoping query

Select to view the query used to generate the analytic.

Entity

Show results based on the selected entity.

Filtered by

Based on selected Entity, choose a filter to apply to the results.

Display type

Select the type of item information to display.

Chart type

Choose the type of chart to display results in.

Number to show

Select the number of top types to display in the analytic.

Show zero values

Select this check box to include zero values results.

Top types report

To generate a PDF report from this analytic, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Specify what should be contained within the report:

Option

Description

Summary data and visualization image

Selecting this option includes both the summary data information and the visualization within the report.

Summary data

This option includes a table that lists the total of each top type identified within the selected entity.

Visualization image

This option includes a copy of the Top Type visualization, as depicted within the analytic.

Choose any additional items to include with the report:

Option

Description

Visualization image PNG

Generate the Top Type visualization as a separate downloadable PNG file.

XLSX

Generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.

Word count

Use the Word Count analytic to generate a list of all words included within the items of the current result set along with their frequency of use.

Click the Analytic Management icon and select the Configure link to view the available configurations for the analytic.

Configuration option

Description

View scoping query

Select to view the query used to generate the analytic.

Filter by

Choose a preferred method to use to filter the results.

Field type

Choose the field type used by the analytic to collect results.

Max results

Set the maximum number of returned results.

Minimum occurrences

Set the minimum number of occurrences a word needs to be included in the list.

Maximum occurrences

Set the maximum number of occurrences a word can must be included in the list.

Word count report

To generate a PDF report that lists all words found by the analytic and the number of occurrences of each, click the Analytic Management icon and then select Configure Report.

Provide a title for the report.

Optional: Choose whether to generate the report as an XLSX spreadsheet in addition to a PDF.

Click Create Report.

Click Download PDF to view the report.