The Galaxy Tab is the generally the first thing you view when using Proactive Investigator. To get started:

  1. For best results, maximize the application window.
  2. Select a date using the calendar controls on the bottom of the Galaxy View. The first calendar control selects the start date, the second calendar control selects the end date. Generally, you are looking at one day at a time.
  3. Click the All Data button
You are now looking at a specific set of indicators: Outlier Access, Outlier Documents, and Outlier Hours. Each system plugged into Pro-I investigator is shown in a different color. These indicators are displayed as spherical coordinates for each box you see. For a good explanation of how this shapes the view, try .

You will normally see a tighter grouping of indicators, clustered together. You will also see at least a few indicators that are distinctly separate from the others. The closer the indicator is to the center, the less "unusual" the activity, the further away, the more"unusual" the activity, and perhaps more worthy of follow up.

3-D visualizations require review from more than one angle. That is what the double row of buttons at the bottom left is for. Try Flip Z for a more dramatic animations, and the ROT buttons to get a better feel for the spherical coordinate space.

Last edited Jun 5, 2012 at 7:15 PM by grant_babb, version 5


No comments yet.