Details

Details sits below the main panels and shows the full information for the row you selected. It follows one main panel:

Syscall Trace: the decoded call and its captured bytes.
Network: the selected packet’s TShark details tree and bytes, or the selected capture’s record.
Memory: the selected Volatility or MemNixFS result row.
Disks: the selected file, dump record or difference.
Run History: the selected run or capture, with its process tree, the analyses that were on and its launch.
Triage: the selected suspicious activity, process, file, network, indicator or BPF row, a changed file’s diff, or a detection match.
Core dumps: the selected mapping, function, string or note.
Static Analysis: the selected row of the shown category, with the category it comes from.

Syscall Trace of a real run with a write call selected; Details below shows write syscall 1 · TID 105 · call 13 as a tree of Arguments (fd 3, buf with its captured data of 29 bytes, count 29), Return 29 and Phases, and beside it the captured bytes original line
unchanged line
in a hex view with Open data…. — Details following Syscall Trace. Antinomie 0.8.0, a recorded run.

When only one of those panels is visible, Details follows it. When several are visible (split or detached), it follows the one you clicked last, or whose tab you chose. With nothing selected in the followed panel, Details says what to select there, such as Select a syscall in the trace to decode it here, Select a run in Run History. or Nothing selected.

In Triage the details sit in a column beside the tables rather than below them, so a table and the row it explains are side by side.

Triage Suspicious activity with one memory.rwx row selected; Details at the right shows Rule memory.rwx, Tier high, Category Defense evasion / anti-analysis, Process, Summary mmap with prot 0x7, Count 3, Source MITRE ATT&CK T1620 · DET0300, Time, Confidence limited, Evidence, Version 2 and Outcome 3 succeeded, then Occurrences, Why this tier, Observed fields and Open original syscall. — A Triage row in Details: why it has its tier, and a button to its evidence. Antinomie 0.8.0, synthetic data.

Details scrolls vertically. It keeps its place while the same run or capture stays selected and returns to the top when you choose another. While a Debugger tab is shown, Details and Activity fold down to their tab strip so the debugger has the height.

Run details in the Details panel: the recorded process tree of dropper with sh, curl and chmod, Network route Not recorded, Analysis enabled as a tree with Static analysis and its checks, Core dump on exit with budget 256 MiB and Network capture, and a folded Launch section. — Details following Run History. Antinomie 0.8.0, synthetic data.

Working with values

Right-click a number to copy it in common formats, and a flags value to copy its Flag names. A captured object opens in its own data window with Open data…, initially as UTF-8; choose ASCII, hex, hexdump, C array, Base64, decimal bytes or an escaped string with Format and copy the result with Copy. A partial capture keeps its gap and error information.

The Network panel of a real run with 14 packets (ARP, a DNS query and response for triage.test, a TCP handshake, an HTTP GET and HTTP/1.1 200 OK); frame 8, the GET, is selected and Details below shows Frame 8 HTTP GET /ANTINOMIE_TRIAGE_FIXTURE_v1 HTTP/1.1, 177 bytes on the wire, Expand all and Collapse all, the TShark tree from Frame 8 to Hypertext Transfer Protocol, and the 177 bytes in hex and ASCII. — A selected packet's TShark tree and bytes in Details. Antinomie 0.8.0, a recorded run.

Selecting a row never opens a hover popup or a second inline inspector; the information is here. Double-click in the source table instead to open the original evidence, for example the syscall behind a Triage row, or use the Open original syscall button in Details.

Some panels also open their own windows from a row’s right-click menu: Show details… and Show bytes… in Static Analysis, and Details… for a detection match, which opens a movable window per finding. See Detection engines.