Searching external sources

Your system administrator can enable you to search multiple external data sources for information that is relevant to your investigation, in various different ways. Analyst's Notebook presents all of the available queries in the External Searches window.

About this task

In general, you can categorize queries for external data sources according to three criteria: Whether you can (or must) provide parameters, whether you can (or must) specify seeds, and whether you can define a structure for a Visual Query.

  • When a query supports parameters, you can customize the query before you run it, with the aim of seeing more targeted results. For example, a query that searches for people might be configured so that you can specify ranges of birth dates. A query for cars might allow you to enter a partial license plate.
  • When a query supports seeds, it changes its behavior when (or does not work until) you select items that are already on the chart. A query might use information from selected items for several purposes:
    • Some queries search for information in external sources that is related to information that is on the chart. For example, they might try to find bank accounts that are known to be operated by a selected person.
    • Some queries use the information from a selected item as a starting point. For example, they might search for telephone calls that happened at around the same time as a selected call.
  • When a query in the External Searches window advertises itself as a Visual Query, you can control how it searches the external data source and what types of records it finds. Visual Queries enable you to look for data structures as well as for single records.

Procedure

In Analyst's Notebook, the External Searches window contains everything that you need in order to understand, configure, and run the queries that search external data sources.

  1. On the Home tab of the ribbon, click External Searches.
    The External Searches window opens, and the queries that your system administrator defined are listed on the Queries page. The list of available queries is displayed in up to three sections: Available with the current chart selection, Available with or without a chart selection, and Not available with the current chart selection. Sections are not displayed if there are no queries available.
  2. Optional: Use the Filter these queries field to enter text that filters the list of queries by name.
  3. Optional: If the list of queries is long, and you know there are some you'll never use, you can hide individual queries or whole connectors from displaying on the Queries page. Click the Add properties icon to show a list of available connectors and queries. Clear the checkbox of any connector or query you want to hide, or select the checkbox of a hidden connector or query to show it again. Your choices are saved locally and persist until you clear your local storage.
  4. Click a query to select it and display more information about it.

    The pane on the right of the Queries page lists the actions that you can perform with the selected query. The same pane also describes what types of information the query can return, indicates whether the query supports or requires seeds, and might include a longer explanation of its behavior.

  5. Unless the query requires seeds that you have not selected, you can click Open.
    What happens next depends on whether the query supports parameters:
    • If the query does not support parameters, it runs immediately and you see a new page that contains search results from the external data source.
    • If the query does support parameters, you see a new page where you can enter values for those parameters before you run the search.
    Note:
    Queries that have no mandatory parameters have an extra action: Copy to chart. This action copies any search results straight to the chart without first showing them in a list
  6. You can delete your search results data from the i2 Analyze server. Click the menu icon Menu in the Queries page and choose Clear search data. If you want to proceed, click the Clear data button. All your search data is deleted and open tabs are automatically closed. This action cannot be undone.

Results

After the query runs, the External Searches window gains a Results view that contains the search results. From here, you can select results and copy them to the chart surface. You can filter the results by type, or use the search bar for text filtering. This gives you several different ways to refine your search, and this is particularly useful when your searches yield a large number of results.