Filtering by columns

To filter a table by a specific column:

In a table of a section of the application web interface, click the filtering icon in the relevant column.
The filtering window opens.
Use the interface elements in the filter window to configure the settings, as necessary. Below are some special considerations when configuring a filter in certain columns.
Click OK.

If the filter window contains the Complex field

Use the Complex field to specify multiple values combined by the logical operator AND. To add different types of values, click Add condition (AND).

If there is a column for groups of devices

In the filter window, click the icon in the right part of the field to select a group.
The Select group in tree window appears.
In the device group tree, select the relevant group and click Select.
The path to the selected group is displayed in the field in the filter window.

If there is a column for risks associated with devices

In the filter window, use the Exclude devices with risks toggle switch to configure the display of devices in the table:
- To view only risk-free devices, turn on the toggle button.
- To view the devices with risks and to configure the settings for filtering by risk, turn off the toggle button.
If necessary, use the following controls to configure the settings for filtering devices with risks:
- Risk score – lets you define a range of risk score values for displaying devices with risks whose scores are within the specified range.
- Status – lets you enable and disable filtering based on the statuses of risks (corresponding buttons are displayed if Show remediated and accepted risks is selected in the devices table display settings).

If there is a Protocol column with display of the supported application protocols

In the filter window, specify the necessary protocol in the Protocols field. To do so, start entering the name of the protocol and select the relevant protocol from the drop-down list (the list of suitable protocols is automatically expanded when the value in the Protocols field is changed).
If required, sort the opened list of protocols by clicking Sort.
If you want to add another protocol, click Add protocol and specify the other protocol in the field that opens.
If you want to delete one of the specified protocols, click the icon in the filter window. You can also delete all specified protocols by clicking Default filter in the filtering window.

If there is a Protocol column that displays all supported protocols in the form of a protocol stack tree

In the filter window, configure how the relevant tree elements are displayed by using the + and - buttons next to the names of protocols that contain protocols of subsequent layers.
The table columns provide the following information:
- Protocol – name of the protocol within the protocol stack tree.
- EtherType – number of the next-level protocol within the Ethernet protocol (if the protocol has a defined number). It is displayed in decimal format.
- IP number – number of the next-level protocol within the IP protocol (if the protocol has a defined number). It is indicated only for protocols within the IP protocol structure. It is displayed in decimal format.
If necessary, use the search field above the table to find relevant protocols.
In the list of protocols, select the check boxes opposite the protocols by which you want to filter events.
If you select or clear the check box for a protocol that contains nested protocols, the check boxes for the nested protocols are also automatically selected or cleared.

If filtering based on the table cell values is allowed

Select the relevant items in the data table.
Move your mouse cursor over a cell of the relevant column of one of the selected items.
Right-click to open the context menu.
In the context menu, select the command that shows all items containing the specific value or values of a parameter.

Modes for filtering events within incidents

When filtering the events table in tree display mode, incidents that meet the filtering criteria may be presented in the following variants:

Displayed with all nested elements
Displayed only with the nested elements that also meet the defined filtering criteria

You can select the relevant display option for incidents by using the Show embedded events when filtering check box when configuring the table.