ONE

On the All Media page, the media view can be changed by following the steps provided below:

• Click on the hamburger menu icon in the top left corner.

  

• In the hamburger menu, click on Media in All items section. This opens the All Media page.

  

• Click on the View or 9-dot icon on the right. This opens a dropdown with two options, i.e., List and Gallery.

  

• Click on Gallery to change the view to Gallery view.

  

• Click on List to change the view back to List view.

  

A timeline can be filtered by following the steps provided below:

• Click on the hamburger menu in the top left corner.

  

• Click on any entity under the All Items section. This opens the All Entities page.

  

• Click on any entity. This opens the entity’s overview. The timeline is on the right.

  

• Click on the View icon on the right. This opens a dropdown of options, i.e., Show Investigative Dates, Show Notifications, Show Notes, and Show Data Updates. By default, all options are ticked.

  

• Check or uncheck any of the options. This refreshes the timeline.

  

• The new timeline contains only the selected items.

  

What is it and how to use it

In Hubstream (Classic), the image safety tool helps users to filter and mask the images they or others in their organization have uploaded.

Filters and masks in Hubstream

Users can use filters and masks to hide parts of an image for their safety. The following table shows the various available types of filters and masks:

How are filters and masks used for the safety and protection of investigators?

The use of filters and masks for protecting investigators from disturbing images (such as child sexual abuse material or CSAM) is invaluable in protecting their mental health.

Goals behind using filters

• To reduce the vividness of the image, making it easier for investigators to look at it without being overwhelmed or triggered by what they are seeing.
• To allow investigators (as a result of the above) to be more focused on getting information from an image instead of getting emotionally attached to what they’re viewing.

Goals behind using masks

• To block out the disturbing parts of the image.
• To help investigators focus their attention on the part of the image that contains helpful information rather than the part that contains potentially disturbing and unhelpful elements.

Types of filters

The following four kinds of filters are available for images:

1. No filter: The first filter removes any pre-applied filter applied to the image. This is also selected when there’s no filter applied to the image.
   
   

2. Gray filter: The second filter turns the image into a grayscale. When the gray filter is applied to an image, it alters the colors of the photo and desaturates them to various shades of gray.
   
   

3. Blur filter: The third filter blurs the image. When it is applied to an image, it has the effect of blurring or obscuring certain parts of the picture. It results in a softer, less detailed look and makes identifying people or objects much more difficult.
   
   

4. Block image: The fourth filter hides the image entirely.
   
   

Types of masks

The masks are present below the filter on the upper right side of the image.

The following four types of mask settings are available:

1. No mask: This setting removes any mask applied to the image.
   
   

2. Small mask: This setting allows viewing the image in a small circle.
   
   

3. Medium mask: This setting allows viewing the image in a medium circle.
   
   
   

4. Large mask: The fourth setting allows viewing the image in a large circle.
   
   

How to use the image safety tool

To use the image safety tool, follow the steps given below:

• Go to an investigation or media section of the hamburger menu. Click on an image to open it. The image safety tool is available on the right side of the picture.
  
  

• Click on a filter to turn the image to grayscale/blur/black.
  
  

• Afterward, click appropriate mask settings to view the image in a particular area.
  
  

• Hover the hand icon over any part of the image to view it.
  
  

What does the investigation overview consist of?

The investigation overview shows insights related to an investigation. It is divided into four parts: header, field sub-header, infographics, and timeline.

• Header: It consists of the breadcrumb, investigation name, and assignee names.
• Field sub-header: It consists of information about the investigation, such as its ID, status, date of received, days open, priority, incident type, and source.
• Menu: It consists of an edit button, add investigation button or plus, timeline view settings, and a three-dot icon with various options to modify and download the investigation.
• Infographics: These consist of links of investigation, such as an address, IP address, etc., and media, map, link chart, etc.
• Timeline: It provides a bird’s eye view of various events by date in the investigation.

The map visualization allows users to view an investigation’s links or related entities with location information on a map.

To view the related entities on a map, do the following:

• From middle panel of the user dashboard, click on an investigation.

• If the investigation has any links with location information, a map tile will become available. The map tile contains a map that displays the location of various links.

  

• Hover the cursor over a link in the map tile to view more information about it. User can also drag across the map to view more related entities.

  

• On the bottom of the map tile, there’s an option to expand the map which appears only on hovering over the tile. Click on it to view the map in full-screen mode.

  

• Hovering the cursor on a link on the map will display a hyperlink along with location information.

  

  • Click on the hyperlink to open the link. This opens a page where more information about the link is available.

    

• Press Esc key to close the full-screen map.

Interface

Hubstream’s interface is divided into the following three areas:

1. Header
2. Side bar or navigation
3. Dashboard panels

Header

The header of Hubstream comprises three important areas, i.e., the hamburger menu, global search bar and the cog menu.

1. Hamburger menu

   

   The hamburger menu is divided into the following four areas:
   1. Dashboards: The user dashboard and the team dashboards are accessible from the hamburger menu.
   2. Reports: It consists of all the different types of reports that are available in Hubstream.
   3. All items: It consists of all the different types of entities.
   4. History: It lets the user view and access the most recent items.
   5. Jump to: It lets the user search a particular item within Hubstream.

2. Global search bar
   The global search bar provides a way to the user to search everywhere on the hub that they have access to.

   

   It has the following parts:
   - Text field: It is the place where the user types in the keyword.
   - Search button: It is used to initiate the search.
   - Search dropdown: is used to view advanced options for searching within the hub that user is a part of.

       The available advanced search methods are as follows:
       a.	Advanced Search
       b.	Hash Search
       c.	Bulk Search
       d.	Bulk Hash Search
   

   Some of the items that can be searched for from the global search bar are as follows:

   • Investigations
   • Addresses
   • IP Address
   • Media
   • Media Series
   • Online identities
   • Online Resources
   • Persons
   • Automations

3. Cog menu

The cog menu consists of the following options:

• User Profile: It takes the user to their profile.
• System Information: It provides basic information about what version of the Hubstream system the user is running.
• Import XML: Clicking on it lets the user import an xml file.
• Import Spreadsheet: Clicking on it lets the user import a spreadsheet into Hubstream.
• Import JSON Case: Clicking on Import JSON Case lets the user import a case from a JSON file.
• Undo Deletes: It reverses the deletion of items.
• System Status: It displays the in-progress tasks.
• Admin: It lets the user manage users on the hub.
• Diagnostics: It helps in diagnosing problems related to the hub.
• Log out: Clicking on Log out takes the user out of Hubstream.
• Help: It takes the user to a new page containing download link for intelligence agent and a video to learn to configure the credentials.

3. Side bar
   The side bar consists of three options, i.e., User Dashboard, Team Dashboard and Reports.

1. User Dashboard: It is the homepage and provides at-a-glance views of KPIs of the user.
2. Team dashboard: It is where the user can get at-a-glance views of KPIs of their team.
3. Reports: It is where the user can view reports about their organization.

The network chart in Hubstream Classic helps users visualise links associated with an investigation. It shows the flow of information and the relationships between different links of an investigation.

Once one or more links have been added to an investigation, follow the steps given below to view the network chart:

• From the user dashboard, click on an investigation to open it.

• Once in, open the side bar and click on Links. A list view of links will open.

  

• On the top right, there will be a grid icon called View. Click on it.

  

• From the dropdown that opens, select Network Visualization. The view will change to a network chart of links.

  

• Some links in the network chart will have a circle on the top right containing a plus sign followed by the number of related links.

  Click on the circle to expand the network chart and view the related links. The number disappears when the node is expanded. Click on the empty circle to close the expanded node.

  

• On the left side of the network chart, various filters are present. The network chart can be filtered using different entity types, link names or link quality. The type of filters shown depend on the type of links available and their field values.

  Click on any filter to apply it. The network chart will change accordingly.

• On the top right of the network chart, various options to modify it are available

  1. Add: The first one is the plus icon that lets the user add more links to the current investigation.

    Click on the plus icon to open the dropdown. Choose the desired type of link, add details and click on Save and close. The new link will be added to the current investigation. Expand the current investigation node to view it.
  

  2. View: Click on the nine-dot icon called View on the top right of network chart. Three options to change the view are available, i.e. List, Details and Network Visualization.

    Click on any other view to change the view. Don't take any action if no view change is required.
  

  3. Tree Layout: Next is a tree icon called the tree layout which shows the network chart in a tree layout. Click on it to change the network chart to tree layout.

  4. Horizontal Tree Layout: Click on horizontal arrows icon to change the network chart to a horizontal tree layout.

  5. Spatial Layout: Click on the Gift box icon to change the network chart to a spatial layout.

  6. Other options: Click on the three-dot icon to open a dropdown containing other options to modify the network chart. The dropdown contains four options, i.e., Expand All, Collapse All, Save Layout, and Clear Saved Layout.

    ![](../../Screenshots/Screenshot%202023-03-22%20165439.png?Web=1)
  
    - **Expand All**: It expands all the nodes of the network chart without having to click on different nodes one-by-one. Click on it to expand all the nodes.
  
    - **Collapse All**: It collapses any or all the expanded nodes. Click on it to close any expanded nodes.
  
    - **Save Layout**: It saves the layout in its current form. Click on it to save the layout.
  
    - **Clear Saved Layout**: It clears the saved layout. Click on it to remove the saved layout.

The team dashboard is a place to view the ongoing activity of the team and related insights. It has the following three areas:
1. Left panel
2. Middle panel
3. Right panel

Left panel

The left panel is divided into two areas, each of which displays an interactive infographic about active investigations. These are Active By Incident Type and Active Investigations By Status.

• Active By Incident Type: This shows a visual representation of active investigations by their incident type, such as misleading words or digital images on the internet, child sex tourism, etc.

• Active Investigations By Status: This shows a visual of the active investigations by their status, such as open, importing, pending etc.

To navigate the left panel of team dashboard, follow the steps given below:

• Hover over various parts of the visualization to see useful insights as tooltips.
• Click on any part of visualisation to filter the list of team investigations present in the right panel.
• Click at the same place again or the filter icon on the top right of left panel to remove the filter on the list of investigations.

Middle panel

The middle panel is divided into two areas, viz. workload and days active.

• Workload: It shows the total number of unassigned investigations and the workload for each individual in an ascending order. It has a scrollbar that allows viewing the workload for each individual member. If there are a lot of members in the team, a More button will be shown at the bottom, clicking on which will expand the team.

• Days active: It is a multi-colour donut representation of the number of days the team members were active for. A legend is present below the donut representation that indicates the time period each colour in the visual denotes.

  To navigate the middle panel of team dashboard, follow the steps given below:

  • Hover over various parts of the visualization to see useful insights as tooltips.
  • Click on any part of visualisation to filter the list of team investigations present in the right panel.
  • Click on it again or the filter icon on the top right of left panel to remove the filter on the list of investigations.

Right panel

The right panel contains the following:

1. The total number of active team investigations
2. The total number of active investigations with the status high priority
3. A list of investigations with the their status and date of last edit.
4. An edit icon to edit an investigation
5. A plus icon to add a new investigation
6. A share icon to share the investigation

To navigate the middle panel of team dashboard, follow the steps given below:

• To filter the list of investigations, click on either the total number of active investigations or the total number of active high priority investigations. This results in a colour-coded filtered list, now containing only the active investigations or active high priority investigations.
• Click on it again or the freshly appeared filter icon on the top right of right panel to remove the filter.
• Click on any investigation to view more details related to that particular investigation.

The user dashboard has three panels, i.e., the left, the middle, and the right panel. Each one of these contains important information about the user’s activity in Hubstream.

Left panel

The left panel of the dashboard consists of two visualizations - Days Active Donut Chart and Active By Source Organization Pie Chart.

1. Days Active Donut Chart: It displays an interactive visualization of the days that the user was active for.

2. Active By Source Organization Pie Chart: It displays an interactive visualization of the days that the user was active for by source organization.

3. Filter icon: It only appears if any part of a visualisation is clicked to apply a filter to the list of investigations. Clicking the filter icon removes the filtering and the icon disappears.

To explore a visualization in the left panel, follow the steps given below:

• Hover over various parts of the visualization to see useful insights as tooltips.
• Click the visualization to filter the investigations displayed in the middle panel.
• Click the visualization again to remove the filtering.

Middle panel

The middle panel shows an overview of the user’s investigations. It contains the following information:

1. The total number of active investigations denoted by active
2. New investigations on the current day denoted by new today
3. New investigations in current week denoted by new this week

This is followed by a list of the investigations created by the user (4).

There are two icons on the top of the middle panel, viz. the plus icon (4) and the list icon (5).

Click on the plus icon to add a new investigation or list icon to view all investigations.

Click on either total number of active investigations, new investigations, or new investigations this week to filter the list of investigations. Click on it again or the freshly appeared filter icon on the top right to remove the filter.

Right panel

In the right panel, user can view the total number of unread alerts, followed by a general timeline that displays important events in all the investigations created by the user.

The right panel is further divided into the following three parts:

1. Alerts: They act as notifications in Hubstream. At the same time, they filter the timeline events. User can click on the alert number to apply the filtering to the timeline.

2. Timeline: The timeline helps users keep track of all the important events related to all the investigations.

3. Filter icon: The filter icon appears only when the user has clicked an alert and in turn, filtered the timeline. User can click on it to remove the filtering from the timeline. This causes the filter icon to disappear.