Introduction

Use the Network Activity page to investigate communications between devices in your organization, identify suspicious network connections, and review detailed information about network traffic observed by Field Effect.

Common uses for this page include:

• Investigating potential lateral movement between devices
• Reviewing communications between endpoints
• Identifying connections to specific IP addresses, domains, or ports
• Supporting incident investigations with detailed network activity data

This article covers the following topics: 

TOC

Access & Navigate the Page

The Network Activity page is accessible from the sidebar's Network section. 

List View

The Network Activity page displays network communications observed within your environment in a table format.

You can customize the table to focus on the information most relevant to your investigation by resizing, rearranging, showing, or hiding columns.

The following columns are available:

• City
• Country
• Destination Domain
• Destination IP
• Destination MAC
• Destination Port
• Duration
• Packets Received
• Packets Sent
• Protocol
• Sensor
• Source Domain
• Source IP
• Source MAC
• Timestamp

Details View

Select a row to view additional information about a network connection in the Details pane at the bottom of the page.

To view the information in a larger window, click the Expand icon. If the activity is associated with an endpoint monitored by Field Effect, selecting the host name link opens the related device on the Agents page.

Customize Columns

You can show or hide columns to create a view that matches your investigation needs.

To customize columns:

1. Click Edit Columns.
2. Select the columns you want displayed.
3. Clear any columns you do not want displayed.
4. Click Apply.

You can also:

• Resize columns by dragging the edge of a column header.
• Rearrange columns by dragging them to a new position.
• Sort columns by selecting a column header.

Search for Network Activity

The search bar allows you to quickly locate specific network activity using keywords or custom search criteria.

To build a search:

• Select a column.
• Choose a search operator.
• Select or enter a value.
• Review the filtered results.

Depending on the column selected, the search tool provides suggested values based on data currently available in the table.

You are not limited to the suggested values and can enter your own search terms when needed.

Example Searches

• Find connections to a specific destination IP address.
• Show activity from a particular source device.
• Locate communications involving a specific domain.
• Review activity during a specific time period.

Sort and Filter Results

To sort results, select a column header to toggle between ascending and descending order.

You can also use search operators to refine the list.

Common filtering options include:

• Is Not: Displays records that do not match the specified value.
• Is Null: Displays records where the selected field contains no value.

As you build a search query, the page provides suggestions to help narrow your results.

Filter by Date and Time

When filtering by date or timestamp fields, the following formats are supported:

• 2022-11-22T16:35:42
• 2022-11-22T16:35:42Z
• 2022-11-22T16:35:42.000
• 2022-11-22T16:35:42.000+0000

Export the Results

You can export Network Activity data for offline analysis or reporting. To export results, click the Export CSV icon.

You can export:

• All network activity records currently available in the page
• Only the results returned by your current search or filter criteria

This allows you to focus on the data most relevant to your investigation.