USA. AUS. CAN, GER. NZL p- 05 March 2009 DERIVED FRUMZJHEJEJE DATED: 20070103 BDMINTHRELTO AUS, CAN, GER, NZL DECLASSIFY ON: 20320108 SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL What is a workflow? a Workflows automate queries. I One?time - Standing Every search type can be a workflow. - Same functionality and capability Follow on actions - Email alert - Download actions - Metadata summary USA, AUS, CAN, GER, NZL 0 08 it 3 WO i?I Anyone! One owner per workflow - Multiple-users can be notified - If ownership needs to be changed, a ticket can be submitted to the team. Future: sharing workflows - Right now, only the owner has the results in their ?My Results? View. USA, AUS, CAN, GER, NZL __Jl at ca I . Workflows can be configured to run once - i Workflows can be configured to run daily - Every hours I You can set an offset to start running at a certain hour - Download results Email results and email alerts MAILORDER results - report USA, AUS, CAN, GER, NZL Why do I want a worktl - XKEYSCORE has a rolling buffer of data Repetitive queries - Sigdev purpose - Fingerprint and appid testing - Queries take a long time during high times - Follow on actions - Google Earth data - Statistics - Customizable write a script! USA, AUS, CAN, GER, NZL USA, AUS, CAN, GER, NZL How do il- 5 Navigation Menu Explorer My Workilows LEJ Search Classic Ii] I: MultiSearoh u] Classic res-M a Classic N-Z .5 Common Category DNI - Document Meladata Email Addresses . lil LEE yup DWrelasa Results - My Reoert Results El My PrHvious ?ssile My Ongoing ?esuls - a My Downloads 3 ?3 statistics El L'nl: Summarizdlon a 3 Testing Emmi Tagging g: Till-h F?rnr?lnr Tam-1mm l] SE USA, AUS, CAN, GER, :i weaning?? .syyitch use}? Preferences Help Welcome to the New IIKEYSCORE Hume Page! If you haye questions or bug reports please go to EKEYSCORE New GUI Forum To use the old GUI, click here HUMAN RIGHTS ACT, USSID 18 AND USSID 9 queries require a justi?cation to ensure Human Righis ea.- (HRAI, USSID 1E: and SSID El compliance. Please enter information as prompted by me query interfaoe. an audit all has been established and will be searched as part of Menwi?'i Hill Station?s response to 1y complaint brought under HRA and as part ofthe USSID la and USSID 9 process. ease note that SENSITIVE TARGETING AP PROUAL (STA) is required for HRA before submitting 1y query which includes terms speci?c to a person or company (eg name, address, identity stalls such as communications address, passportg?bank account number) who EITHER is sfined as a UK, British Dependent Territory or Second Party "person" or is located Second Party country. is also required for wildcard pulls ?oat are eritabiy going to retriye a substantial proportion of such enties wildcarding on a UK city idej. Full legal guidance is ayailable from the HRA Compliance Offioer at Menwith Hill Station. cm i: dunond Fur-Ion n. ur'. ,Jl NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL How do I setup a workflow?? .I . I . Wurk?ow Central Request Wizard IFS a 3 Please select a SEarch Type. 1 Every session collected} indexed by "standard" DNI meta-data (teifmm 1P, port; casenatatiun, application id, sigad, etc). lFull Lug IVI 1 Search Type Help 5* . Cancel 4 Prev 9 Next jut-T." USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL How do I setup a workflow: work?uw Central Request wizard II x. 0 r- 0 6- Basic Information . let be unique per user We" Findme-apfj'd_ must have a justification Query Justi?cation: Testing appid Signature . on 3 ?dditional JuSti?EatiDn: .V Miranda Number: Datetime:l1Dey 45m:anaemia-um 3am: mamas @2359 $29 Reccurring Search Elne Time Search Basic Features Help 1" Rune once over a set datetime range . Cancel ?1 Prev 9' Next USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL How do I setup a workflow Wet-knew Central Request Wizard 8 I 0 Add Search Fields Search values are by default. 8 a To OR Search Fields: Use the Multiple Field Search tab (below the input ?elds). Select all the ?elds you wish in search. To UR Search lti?elues: Type between each tralue (no quotes). See Search Value Help below for more details or salad: 3 for a description of boolean logic go in here. field to I Search Field Search Value Remove 333 K. From IP Address oe To IP Address 1.2.3.4 Attribute it From IPAddress _i To IPAddress To Port 1 :1 1 or every field, Single Field Search Multiple Field Search I Search Hattie Help Ie key Cancel ?3 Prev [3 Next ii USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL Group by option Wurkl?low Central Request Wizard DGroup :1 ita results. Group Search Fields Would you like to group omr ?elds? 0 Red to. Na Yes RetL Group By Type Table Unique Values: f: Emu 6 Hal Global Unioue ililalues: Columns to Group By Datetime: Client ID This option groups eeoh maW?rT??rE and concatenated. Username: ?ittribute Info: From 113 ?ddress: To IP Address: From Fort: To Port: Select the fields you want to group by. From Country (IP21: To Country (IF): From Cit?; (IF): 717777/?177177 TCI Cit}! (IF): 5 From Latitude 1. Ll I Cancel 4 Prev 9' Next USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL Select databases i Work?uw Central Request Wizard Select the Detebase?} to l? xks- :qtl (HRS l? sks- :qsummar? txks- unsummaw) l? [:untent must exist Checki?ill Uncheck All Basic Features Help If this is selected, results are only returned if the content still exists at site. Cancel <1 Prev it USA, AUS, CAN, GER, NZL USA, AUS, CAN. GER, NZL Follow on Actions i Work?nw central Request Wizard QAW Fullo w-un Actions You like tn add any follow on actions l? Nu Ioca ems . script 3mm ?rswnents Add UAW . . I lEmaiI Mart Ev '3 ERCIWR: Return [:1an With Results Report Download Sessions EamWa?imt has:me plated. Next I 1 Cancel ?1 lire-uf USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL Email alert I [antral Request Wizard Fallow-on Actions you like to add any [allow on actions Comma delimited email ivll 5-: addresses. I EerltitiFt: I- Fteturn Only With Results A . . i. - This option only sends an email if you werkflow has results. . Cancel 4 Prev 1" Next I USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL SQL report Wurk?nw [antral Request Wizard Ful l?l'll -un Actions Email Subject: Email Content Ema? Attachment: ROWE: Filename'. Mail Order Trigraph: EQL: Cancel 4 Free' Would 1mu like to add any fallow on actions if? He 35' YES Script Script Arguments Add e: SQL Report iv Email Tu: i? Email Attachment or F'Return Only With Results Thib '[lUbt '51 Sm ghetadata that a user can set. Exarrlpie. SELECT A- . . FROM :l SELECT casenotatlon, Slgad WHERE stow? Err Ll. Cempress Contents FROM WHERE sigadl=? GROUP BY casenotation lr Next USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL Download Results Wurk?uw Central Request Wizard Fallow?an Actions i Would you like to add any follow on actions Yes ms-cript Script ?rguments "Add I 1User ID: I I- anwnInacl SESSIONS =Ema?ll Tn: Subject: I Email Content: .RDWR: 1? Return Dn1y With Results ,lFilanarne: {Mail Order jTrigraph: HBEIP: l? Compress Contents 1Istancl To Agihts: 1' Sand Tn agility Cancel ?1 Prev Next SECRETHCOMINTHRELTD USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL You?re almost done! WI, Wnrk?uw [antral Request Wizard 5 - Werk?nw ReviewI This query (Find_rni_.v_appid} will search the Full Lug table in databaeem: xks-jychanml] The query will run executing every 6 hours beginning at 5:00 EST The query will execute the following search cliteria: {and} ??eld 2::me IP Address if ?eld:- {value 3-1.2 .3 .4 (I value:- and {and {field?-Tn Film-:3i ?eld:- ?value >30 if value} {If and {and {?eld hAppID ?eld:- {value :a-searchf gaogle value:- {f and Wei-knew IIll-elues I Work?ew XML . Cancel 4 Prev Subm?: - USA, AUS, CAN, GER, NZL USA, AUS, CAN. GER, NZL Workflow Pending Tl'is' E-T run: 41' an ?inc-II II.- .--I- :i - I I aII-vll-ih-"L ..I c5" I:r11'- Welmme: Hume Central ll Search :3 Results Iagg'ng a PrBFEIen-zes Help meme Wham Men" g? Work?nm . i . ?ee: - 3 e3] Wursbe Wee Gum Name Last hilt-timed a?equ? 14:14: - 3 ?c?eele 'jthtiEeElrch El (Jessie Clara-sic El Emmnre DH Elmeurnert metedete game EErz?lreeteu Fllee State A Actions EHTTP Meir - Emene Number Extreme: ELEM Anti-elf a His Trenefer El ?hMiEeamh gale Addresses Elna: ELEM-same Newark Management El?eeml'l Wizard . 2 a,?va El D?tsu?e Elf-mf Recent Heeurte grey Heeul'te Era-1e angel-lg ?esutts -EIW me?eede 3 ?endis?es ELHII: Summariz?len :l Tagger-3 mm 1] 1 Pagall ?99539: Dhelaeinel-It-FI TD USA, AUS, CAN, GER, NZL USA, AUS, CAN. GER, NZL Workflow Approved rn .a-J-zita-zl and Human Hutu-Its -3 4' . - Welmmeu? switch uaers I Hams wurlc?nw Central '1 Sassth Li, El statistics Tagging a. Preferancas :Ha?qa?nn Hen" II Watk?nws a?Eprmr EIHDJTIE Ha: Emmi Wnrk?nw: - tn Cant I Quart Twe .. .. . .. .. ?a {Ft-mil 1.I:r -- Emm? fun?mg :quer?nbsz- El '3 535m? 35:21am: {jut} in; MurtiSearch Hamill} L, Clam; M, ?kgysarjame Imyser?amah mm?: a CD "1m" 5' {queryjuati?EHWbTESting magi; signature El Metadata - a Ems: Adm-?23533 sinteruaIsE-{fntewals Fuss m] Lag [m1 {Iggt?tjm?'l? El Adi'al'it'f {E??heres HG sans rd El -3 Dmn?t HM walues 1.2.3.4-ccfualue: a r:th I e: {and} sand? El Is Addr?s?s fl?elds METERS swa nasal-is?th ues afar-Id} a sand: ?3 ?magma? :?eldsmerprintsf?ehjs 3 {Hand} .3 {jwheres .3 Dwrelm 412:,? gruupjys El Results :Indaxaswnma {advanceds 7 I Elm? New? I LEW {rnutings [am-Imus . LI. [amt - I Tagging Carmel Save??Fin FHrAr-Inr Tann?nh I I Flag! ll? DE 1 I) 1 Fag! Slag. [Eliaymg a Tl emails-d 11.1: 1E: and Human . TD USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL Common mistakes DFrom IP and To IP with the same value. Elln this View, terms are together. DUse Multiple Field Search Tab. Work?uw Central Request Ili'lPizeird Add Search Fields Search Values are by default. Tu DR Search Fields: Use the ivlultiple Field Search tab {below the input fields}. Select all the ?elds you wish in seard'i. Te Search Values: Type between each value (no quotes). See Search I?r'alue Help helew ?er mere details or for a description of heelean legit go to here. riwu Search Value ?11; Address es Te IP Addresb 1.2.3.4 Attribute Ime Frern IP Address Te IPAddress LIL Te Pert Remove 3 1 Single Field Search Search italue Help Cancel 4 Prev it Next USA, AUS, CAN, GER, NZL USA, AUS, CAN. GER, NZL Common mistakes Work?ow Central Request Wizard DUsing the multiple mammal. Search Values are by default. DR F'eld break '8 up Into Use ?fe-lidulltipiesField Search tab (below the input ?elds). search <->Value To W's? ?3 3m? Type between each value (no quotes). See Search Value Help below for more details or - for a description of boolean logic go to m. separately In the . . - - Search Field Search Value Remove - Slnge fleldsea l'Ch . From IP Address 1.2.3.4 To IP Address 5.5.18 From Fort Bl] . V. I Single Field Search I Multiple Field Search Search 'ii'alue Help Cancel *1 Prev l? Next Eur-x9 USA, AUS, CAN, GER, NZL USA, AUS, CAN. GER, NZL Common mistakes Work?uw Central Request Wizard DThis will return ALL casenotations. Add Search Fields Search Values are by default. Te EIR Search Fields: Ba Use the Multiple Field Search tab (below the input ?elds). ,5 Select all the ?elds you wish t3: search. by la but a does Tu DR Search Values: Type between each value (no quotes}. equal?b? DAII the defeated See Search Value Help below ?Jr more details or for a descriptidn ef heelean legit go to here. Seareh Field Search Value Remove values must be 222222: :2 together. Cesendlatien ld Single Field Searth I Multiple Field Search Search 1Il'elue Help 1' Cancel 4 Prev 9' Next USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS. CAN. GER, NZL Common mistakes Werk?nw Central Request Wizard If you are selecting specific SIGADs, only Search Values are by default. Te DR Search Fields: Use the Multiple Flelcl Search tab (below the Input ?elds}. have ata fro Select all the ?elds yclu wish 1le search. Te BR Search Values: 8 . Type between each value (ncr quetes). see Search yelue Help below for more details er a ueries wi return for a descripticln beelesn legic gel to here. Search Field Search Value Remove Cesenotetipn 3 big lie-walla" ti ?ll?I DLess work for the SIGAD e; system. Select the Detabese?) to query villus sites sites -NZ sites Content must exist Uncheck All Basic Features Help Cencl USA, AUS, CAN, GER, NZL SECRETHCOMINTHRELTD USA, AUS, CAN. GER, NZL Common mistakes Wurk?ow Eentrai Request Wizard . le you select the Wm?d rnuiike to add anyiulluwun actions make sure you put a tit. valid SQL statement! ?as Fallow?an Actions Script Script Arguments Add . SQL Repnrt 1v 03in? iv 'Ema? To: Email Subject: "My Work?ow Resuits . "l 5 1: SQL statement filled in. m" i' "t Erna? Email attachment ROWE: l? Return Only With Results CO rE F?enarne: Mail Order WHERE oasenotation!=? GROUP BY oasenotation SELECT catenmtatim FROM WHERE tattigtitqtatipti! GZIP: - Cams! 4 PPM 9 Next USA, AUS, CAN, GER, NZL USA. AUS. CAN, GER. NZL ms :3 . I xks_workflow r1 .r.nsa BUMINTHRELTO USA, AUS, CAN, GER, NZL