last updated: September 25, 2025
PREREQUISITES
-
Knowledge of field mapping.
-
Knowledge of artifact instantiation.
-20250919-220908.png?cb=8ee6c2b5d1122b47d5c754408c8fa349)
Viewing Related Events
-
Navigate to the Investigation Dashboard > Artifacts > All Artifacts panel.
-20250919-234837.png?cb=29fcd7bbe5003cbfdf7d7876305d6fa3)
-
Select the site that matches the one configured when generating the EFM API key.
-
Click on an artifact record, then navigate to the Related Events tab.
-
Click on an event record, identifiable by its unique ID number.
-20250919-220955.png?cb=c47e6b8d17662141b4fb180a9e8b6f83)
The Total Event Count column attribute in the Investigation Dashboard > Artifacts > All Artifacts table indicates the number of related events linked to each artifact record. The following sections introduce required matching factors for grouping related events and non-impacting factors.
Required Matching Factors
-
Value of the payload target key
(artifact name)
REMINDER
Artifacts instantiate only when all instantiation criteria are met.
Non-Impacting Factors
-
Integration
-
Event source
-
Name of the payload target key
-
Position of the matching target field in the JSON payload
-
Position of the EFM record in the mapping table
-
Artifact role
-
Relationship configuration