Filter data

Filter lists to display data that matches specific criteria.

Although the process for defining a filter varies by page, the basic instructions are the same throughout the system.

The following procedure explains how to filter the alert list.

On the Alerts page, expand Edit Filters.
Set one or more filter criteria by selecting the relevant values in the drop-down list, such as, Sensor, DBMS, Resolution, Rule Type, Archives, Level, DBMS Groups, Time, or Compliance.
Note
Any free text field filters also seek a match for the string entered as a substring of the field's value. For example, if you enter General SQL in the Rule Name field, all alerts triggered by all General SQL injection rules are shown.
From the Display alerts per page drop-down list, select the number of alerts to be displayed on each page.
(Optional) To sort the results according to specific criteria, click Sort Options, then set the sort criteria.

In the other fields, such as, Module, Client ID, OS User, User, Host Name, and Application fields, enter one or more of these symbols to define the matching criteria.

For example, consider filtering alerts for users, namely user1, user2, john_, and sys.

Symbol	Definition	Example
No symbol	Similar	User filter	Expected results
		user1	Alerts from user1 is displayed.
		user	Alerts from user1 and user2 are displayed.
		u_er1	Alerts from user1 is displayed.
		user_	Alerts from user1 and user2 are displayed.
=	Exact match	User filter	Expected results
		=user1	Alerts from user1 is displayed.
		=user	No alerts displayed.
		=u_er1	No alerts displayed.
		=user_	No alerts displayed.
!	Not similar to	User filter	Expected results
		!user1	Alerts for sys, john_ and user2 are displayed.
		!user	Alerts for sys and john_ are displayed.
		!u_er1	Alerts for sys, user 2 and john_ are displayed.
		!user_	Alerts for sys and john_ are displayed.
!=	Not the same as or equal to	User filter	Expected results
		!=user1	Alerts for sys, john_ and user2 are displayed.
		!=user	Alerts for the 4 users are displayed.
		!=u_er1	Alerts for the 4 users are displayed.
		!=user_	Alerts for the 4 users are displayed.
\	Ignore escape characters	User filter	Expected results
		john\_	Alerts for john_ is displayed.
		john\_\_	No alerts displayed.

There are two wildcards used in conjunction with the LIKE operator:

% — The percent sign represents zero, one, or multiple characters.
_ — The underscore represents a single character.

Click Apply.

RESULT_266DE5649B7F4CFE9BE1DCF88C61671D The alert list displays only those alerts that match the filter criteria.

Note
To deselect all filter selections, click Clear.