Filter lists to display data that matches specific criteria.
Although the process for defining a filter varies by page, the basic instructions are the same throughout the system.
The following procedure explains how to filter the alert list.
On the Alerts page, expand Edit Filters.
Set one or more filter criteria by selecting the relevant values in the drop-down list, such as, Sensor, DBMS, Resolution, Rule Type, Archives, Level, DBMS Groups, Time, or Compliance.
Note
Any free text field filters also seek a match for the string entered as a substring of the field's value. For example, if you enter
General SQLin the Rule Name field, all alerts triggered by all General SQL injection rules are shown.From the Display alerts per page drop-down list, select the number of alerts to be displayed on each page.
(Optional) To sort the results according to specific criteria, click Sort Options, then set the sort criteria.
In the other fields, such as, Module, Client ID, OS User, User, Host Name, and Application fields, enter one or more of these symbols to define the matching criteria.
For example, consider filtering alerts for users, namely user1, user2, john_, and sys.
Symbol
Definition
Example
No symbol
Similar
User filter
Expected results
user1
Alerts from user1 is displayed.
user
Alerts from user1 and user2 are displayed.
u_er1
Alerts from user1 is displayed.
user_
Alerts from user1 and user2 are displayed.
=
Exact match
User filter
Expected results
=user1
Alerts from user1 is displayed.
=user
No alerts displayed.
=u_er1
No alerts displayed.
=user_
No alerts displayed.
!
Not similar to
User filter
Expected results
!user1
Alerts for sys, john_ and user2 are displayed.
!user
Alerts for sys and john_ are displayed.
!u_er1
Alerts for sys, user 2 and john_ are displayed.
!user_
Alerts for sys and john_ are displayed.
!=
Not the same as or equal to
User filter
Expected results
!=user1
Alerts for sys, john_ and user2 are displayed.
!=user
Alerts for the 4 users are displayed.
!=u_er1
Alerts for the 4 users are displayed.
!=user_
Alerts for the 4 users are displayed.
\
Ignore escape characters
User filter
Expected results
john\_
Alerts for john_ is displayed.
john\_\_
No alerts displayed.
There are two wildcards used in conjunction with the LIKE operator:
% — The percent sign represents zero, one, or multiple characters.
_ — The underscore represents a single character.
Click Apply.
The alert list displays only those alerts that match the filter criteria.
Note
To deselect all filter selections, click Clear.