-
To create an Correlation Graph advanced
search filter, go to Detections > Correlated Events, and then click on the Correlation Data icon (
) under Details.
-
Click on the filter icon (
) located next to the Playback Bar to display the advanced search filter.
- Select an attribute and an associated operator.
-
Do one of the following to provide an action:
-
Type a value in the text box.
-
Select a value from the drop-down list.
Tip:Type a keyword to search a partial match.
For details, see Network Detections Advanced Search Filter.
Note:You can add multiple criteria entries by pressing ENTER after typing a value.
-
- (Optional) Click AND or OR to include other criteria sets in the search filter.
-
Click Apply.
The Correlation Graph is updated and displays data filtered by the search criteria. All search criteria sets are displayed above the Correlation Graph.
-
Click the Save button (
) and select Save as.
The Save As dialog appears.
-
Type a name and an optional description, and then
click Save.
The name of the new saved search is added to the list of saved searches.
Parent topic: Correlation Graph Advanced Search Filter