OS change event distribution is shown in a bubble chart by default. The larger the bubble, the more frequent the event. The number of bubbles, represented in different colors, gives you a quick sense of how many different types of OS changes have occurred. Yellow flags indicate suspicious events and red flags indicate malicious events.
.png)
In the Web UI, click eAlerts > eAlerts > Alerts.
Select an alert. For alerts that have embedded file attachments, expand the alert and select the alert for the embedded malicious file.
Note
Duplicate alerts for files with embedded file attachments cannot be expanded.
In the left navigation bar, click the OS Change Details link for a guest image.
Click the Event Distribution tab. The bubble chart shows in the Sequential view. Corresponding details are shown in a table below the chart.
To see the number of events represented by a bubble, hover over the bubble.
To remove the event name labels from the bubbles, clear the Event Name checkbox at the top right of the Event Distribution section.
To hide the bubble chart and view the table only, clear the Event Distribution checkbox at the top right of the Event Distribution section.
To filter the table by an OS change event type, click a bubble. Click the bubble again to show all events.
To filter within the current display, enter text in the search fields above the table columns.