The Events Stream
Events ingested into Workstation become part of the Global Events Stream. This stream is dynamic: it continuously updates as new events are created, existing events are updated, or events are deleted. The Global Events Stream can contain many different types of events, including:
- Events representing people, places, or things.
- Events reflecting changes in risk scores.
- Events containing specialized data, such as linkages or geospatial information.
There is a single Global Events Stream shared across Workstation. Every workspace subscribes to this stream by default. However, each workspace can independently narrow what it displays by applying searches and filters, allowing users to focus on only the subset of events relevant to their current analysis.
Using the Global Events Stream
The Global Events Stream can be connected to the following widgets:
Connecting the stream allows these widgets to continuously receive and update events based on the current workspace filters.
Connecting the Global Events Stream to Widgets
The following steps assume your workspace already contains either an Interactive Map or Link Analysis widget.
To connect the Global Events stream to a widget:
- From an open workspace, locate the Events Stream icon in the left-hand drawer.
- Click Events Stream to open the Events Stream drawer.
- In the top-right corner of the Events Stream drawer, locate the Link icon.
- Click and drag the Link icon into one of the following widgets on your workspace:
- Interactive Map
- Link Analysis
Once connected, the widget subscribes to the Global Events Stream and updates as new events are ingested or filters change.
Applying Filters to the Global Event Stream
You can filter the Global Events Stream to control which events are visible within a workspace. Filters are applied using Global Search Facets and affect which projects, event types, and data fields appear in the stream.
Filters applied to the Global Events Stream only apply to the current workspace. Different workspaces can have different filters applied simultaneously.
At the top of the Events Stream drawer, three filter tabs are available.
Projects
Filters events by project and event type. Click an event type to toggle it on or off.
- Closed eye icon: Event type is excluded
- Open eye icon: Event type is included
- Use All Projects to quickly select or deselect all event types.
Types
Filters events by link analysis type:
- None
- Entity
- Linkage
Details
Applies field-level filters to event data.
- Define conditions on specific data fields (for example, string, numeric, date, or boolean fields).
- Combine multiple conditions to narrow results precisely.
After configuring filters:
- Click Apply Filters to activate them.
- Click Reset All Filters to return to the default state.
- Click Cancel to discard changes.
Once applied, these filters determine which events flow through the Global Events Stream and into any connected widgets (such as Map or Link Analysis).
Data Field Conditions
Details, or data field conditions, add some logic to help with matching data within specific fields. The following table outlines various conditions that can be applied as conditional filters in the search facet data fields tab:
| Data Type | Conditionals |
|---|---|
| String | Contains, equals (case insensitive), exists |
| Date Time | Between |
| Integer | Equal to, not equal to, greater than, less than, greater than or equal to, less than or equal to, between, not between |
| Float | Equal to, not equal to, greater than, less than, greater than or equal to, less than or equal to, between, not between |
| UUID | Contains, equals (case insensitive), exists |
| Geo | Exists |
| Boolean | True, False, Exists |
To add conditions to data field search facets:
- At the right of a data field entity, click the + button to open data field conditions.
- Click the dropdown conditional menu to select a condition.
- Enter a search term if applicable.
- Click the checkmark to save the data field condition, or the X button to discard it.