Kaspersky Unified Monitoring and Analysis Platform

Filtering events

In KUMA, you can specify what events to display in the events table using the query builder or SQL queries. Both search methods are interchangeable and search conditions can be viewed or created using either of them.

You can also modify filters in the events table using these shortcuts:

• Changing the filter from the Statistics window

  To change the filter from the Statistics window:

  1. Open Statistics details area:
     • In the drop-down list in the top right corner of the events table select Statistics.
     • In the events table click any value and in the opened context menu select Statistics.

     The Statistics details area appears in the right part of the web interface window.

  2. Open the drop-down list of a needed parameter and hover the mouse over the needed value.

     A plus and a minus icons appear near the value.

  3. Change the filter using plus or minus icons:
     • To include into the events selection only events with the selected value, click icon.
     • To exclude from the events selection all events with the selected value, click icon.

  As a result, the filter and the events table will be updated, and the new filter expression will be displayed in the top right corner of the Events window.

• Changing the filter from the events table

  To change filter from the events table,

  In the Events section of the KUMA web interface, click any event parameter value and select one of the following options in the opened menu:

  • To include into the events selection only events with the selected value, click Filter by this value.
  • To exclude events with the selected value from the events selection, click Exclude from filter.

  As a result, the filter and the events table will be updated, and the new filter expression will be displayed in the top right corner of the Events window.

• Changing the filter from the Event details area

  To change the filter from the event details area:

  1. In the Events section of the KUMA web interface, click the relevant event.

     The Event details area appears in the right part of the window.

  2. Change the filter using plus or minus icons near parameters you need:
     • To include into the events selection only events with the selected value, click icon.
     • To exclude from the events selection all events with the selected value, click icon.

  As a result, the filter and the events table will be updated, and the new filter expression will be displayed in the top right corner of the Events window.

You can also filter events by time period. Filter configurations can be saved. Existing filter configurations can be deleted.

Query builder and SQL search queries can be used to specify the number of events that are loaded per page. If the specified filter returns more events than can be displayed on one page (according to settings), when you reach the end of the page, the Show more events button appears. The maximum number of events that can be displayed on the page is specified in the LIMIT section of the query builder or in the LIMIT parameter of an SQL query. This functionality can be used only when events are also filtered by the time period.

Filter functions are available for users regardless of their roles.