Adding a Correlation Graph Advanced Search Filter

Procedure

1. To create an Correlation Graph advanced search filter, go to Detections → Correlated Events, and then click on the Correlation Data icon () under Details.
2. Click on the filter icon () located next to the Playback Bar to display the advanced search filter.
3. Select an attribute and an associated operator.
4. Do one of the following to provide an action:
   • Type a value in the text box.
   • Select a value from the drop-down list.

   Tip Type a keyword to search a partial match. For details, see Network Detections Advanced Search Filter.

   Note You can add multiple criteria entries by pressing ENTER after typing a value.

5. (Optional) Click AND or OR to include other criteria sets in the search filter.
6. Click Apply.
   The Correlation Graph is updated and displays data filtered by the search criteria. All search criteria sets are displayed above the Correlation Graph.
7. Click the Save button () and select Save as.
   The Save As dialog appears.
8. Type a name and an optional description, and then click Save.
   The name of the new saved search is added to the list of saved searches.