Kaspersky Anti Targeted Attack Platform

Filtering using a period on the timeline

To filter nodes and links, you can select a time period on the timeline. The timeline is displayed in the lower part of the network interactions map window.

The timeline contains the following elements:

• The starting date and time of the timeline.
• Periods when events with scores of 4.0 and higher were recorded. These periods are displayed as red bars in the lower part of the scale. Periods are not displayed if the configured length of the timeline is more than seven days.
• Filtering period. This period is displayed as a yellow bar with dragging handles at both ends.
• Graph of traffic volume processed by the application. The graph is not displayed if the configured length of the timeline is more than seven days.
• The end of the timeline. Depending on the filtering period, the end of the timeline is displayed as a date and time (if a date and time is specified) or as a Now link.

The following types of filtering periods are possible:

• Period with reference to the current moment. The right end of such a period coincides with the right end of the timeline corresponding to the current moment.
• Period without reference to the current moment. A period of this type can be placed anywhere in the timeline.

To configure filtering of objects by period with reference to the current moment:

1. Click the Now button to the right of the timeline. This button is not displayed if the period is already defined with reference to the current moment.
2. If you want to specify a different length of the period, do one of the following:
   • Drag the left end of the yellow period bar to the required position (the maximum length of period is 7 days).
   • Open the settings window by clicking the button above the yellow period bar, select the Anchor to boundary check box, then select a duration (Hour, Day, 7 days) and click OK.

The network interactions map displays only those nodes and connections for which interactions were detected from the beginning of the specified period to the current moment.

To configure filtering by period without reference to the current moment:

1. If the period you want to set is out of bounds of the timeline, change the start and/or end date and time of the timeline:
   1. To change the start date and time of the timeline, click the link in the left part of the timeline to open a window and in that window, select one of the following options:
      • Day.
      • 7 days.
      • 30 days.
      • Set the date. For this option, specify a date and time in the displayed field.
   2. To change the end date and time of the timeline, click the link in the right part of the timeline to open a window and in that window, select one of the following options:
      • Now.
      • Specify a date. For this option, specify a date and time in the displayed field.
2. Set the period you want. To do so, do one of the following:
   • Drag the period on the timeline to where you want it to be.
   • Move one or both edges of the yellow period bar on the timeline to where you want the period to be (the maximum length of a period is 7 days).
   • Open the settings window by clicking the button above the yellow period bar, then select a duration (Hour, Day, 7 days) and click OK.
3. If the period is automatically anchored to the current moment (when you move the period to the extreme right position, the Now button to the right of the timeline is no longer displayed) and you don't want this, disable the automatic anchoring. To do so, open the settings window by clicking the button above the yellow period bar, clear the Anchor to boundary check box and click OK.