Search History & Search Sessions
Learn how to search history and search sessions to organize your usage as you use the Validin UI
Search History
Every indicator you look up — domains, IP addresses, hashes, and strings — is automatically recorded in your search history. This lets you retrace your steps and understand how you arrived at any particular indicator.
You can view your search history by clicking the timeline icon (— the clock/timeline button in the search bar on the Detail view). This opens the Pivot History popup, which presents your investigation from several angles:
Tree View
An indented tree showing the chain of pivots that led to your current indicator. Each node is color-coded by type:
- D: Domain
- I: IP address
- H: Hash
- S: String
Nodes you have visited more than once are marked with a repeat badge (e.g. ×2). The current indicator is highlighted in yellow. Clicking any node navigates to it.
Provenance View
A three-column view focused on your current indicator:
- How You Got Here: the ancestor chain that led to this indicator, with depth numbers
- Current Node: details about the indicator, including when you first visited it and how many paths led here
- Related Nodes: other indicators you visited from the same ancestors, useful for spotting parallel leads
You can filter all views using the search box in the top bar of the popup. You can also download the raw history data as JSON using the download button.
Search Sessions
By default, your search history grows continuously across all your investigations. Search Sessions let you organize searches into named groups, so you can keep automatically track your search history to keep different cases separate and review each one independently.
Starting a Session
The Search Session picker appears in the top bar of the Detail and Lookalikes views, to the left of the bookmark icon. It shows a timeline icon with the active session name (or "No Search Session" if none is active).
Click the picker to open the dropdown, then choose New Search Session… and give it a name. Once created, it becomes immediately active.
Recording Searches
While a session is active, every search you perform is tagged to it. The session name is shown in the pill at all times so you know which investigation is currently being recorded.
Switching and Stopping
- To switch to a different session, click the picker and select it from the list.
- To stop recording without deleting the session, choose Stop Search Session. Your history up to that point is preserved.
Viewing a Session's History
Click the timeline icon next to any session in the dropdown to open a full tree view of every indicator visited during that session. This uses the same Pivot History tree described above.
Renaming and Deleting
Each session in the dropdown has a pencil icon to rename it and a trash icon to delete it. Deleting a session removes the session record but does not affect the underlying search history.
Persistence
Your active session is remembered in your browser. If you open a new tab or refresh the page, the same session remains active. Sessions themselves are stored to your account, so they are available across devices when you log in.
Updated 8 days ago