Recognition Modes

Choose how you want to search.

There are four ways to harness the power of Polarity. Choose the mode that’s right for you either from within the main window, the Polarity Overlay or via the Polarity icon in the system tray.

1. On-Demand Only

   • Real-time recognition is off, but you can still execute a search in Polarity.

2. Stream

   • Polarity will automatically stream information in real-time to the overlay when more context is available.

3. Highlight

   • Information is highlighted in real-time. Hover on highlights to get more details.

4. Focus

   • Take a screenshot of a section on your screen and lookup any indicators within that section. 

On-Demand Only

Force a search when you want it

Users can run On-demand searches regardless of what recognition mode is being used. In this mode entities will not be highlighted when recognized.

There are three ways that you can use the Polarity On-Demand Only mode: 

Shortcut keys - Select/Highlight the text you want to obtain more context on press and hold Ctrl + C (or CMD + C (Hold) for macOS) for about 2 seconds.  This will run an On-Demand query against all subscribed Integrations within Polarity.

Search My Clipboard - You can also right click anywhere within Polarity (or select the Search My Clipboard option from any Polarity menu).  Clicking Search My Clipboard will take any data that is already on your clipboard and run a query against all subscribed Integrations within Polarity.

Focus Mode - To Activate Focus Mode, use the keyboard shortcut CTRL + Alt + A. Your mouse cursor will transform into a green pointer to indicate that Focus Mode has been activated.  Click down on your left mouse button and drag your mouse over the area of your screen that you want the On-Demand search to be run on then release the button when done.

Focus Mode

Focus mode allows you to run an On-Demand search by drawing a box around the area of your screen that you want Polarity to return results for.  This mode is particularly useful as it enables you to harness the power of Polarity’s On-Demand mode even when not being able to interact with the data on your screen!

Further tweaks to how Focus Mode works for you can be made in Recognition Settings.

QR Code Recognition 

With the Polarity Intel Edition Client version 5.2.2 release, analysts can utilize the QR code recognition feature in Focus Mode.  

An analyst need only trigger Focus mode through the button or with the Shortcut Key, then use the reticle to draw a box around a QR code. 

The analyst will then get any information on URLs, domains, IP addresses, and more that are contained within that QR Code.  Enabling analysts to quickly triage QR codes now to determine if there is any nefarious occurring within the QR code. 

QR Codes in Action

Stream

Automated search while you work

Polarity automatically streams contextual information into the Polarity Overlay based on the content of your active application.

Highlight

Highlighted search while you work

Polarity highlights keywords in your active application. You can mouse-over highlighted keywords to populate the Polarity Overlay with related contextual information.

Switching Between Modes

There are two ways to switch between the On-demand, Stream, and Highlight modes:

1. Overlay Window Switches

2. Shortcut Keys

Overlay Window Switches

Select your mode of choice by clicking on one of the three toggles at the top of the of the Polarity Overlay window.

See Common Terminologies Used for more info on system trays and menu bars.

Users can also choose to run both the Highlight and Stream modes at the same time.  For more info on how to do this see Simultaneously Run Stream and Highlight.