Using the Event Smart Filter

Information displayed in the list can be easily filtered to narrow the focus to only those threat events of interest. One way to do this is by using the Smart Filter.

The Smart Filter contains several default filters. You can also define your own custom filters.

Note: The Events since option can be used to adjust the amount of information displayed within the pane prior to using the Smart Filter.

Default Filters

The Smart Filter contains several default filters that are identified by a leading asterisk. Default filters cannot be modified or deleted. The default filters include the following:

Custom Filters

You can create your own custom filters. This is a powerful tool that enables you to specify exactly which events you want displayed. Each custom filter is comprised of one or more rules. You can define as many rules in a filter as needed.

To create a new filter:

  1. Click the Create a New Smart Filter icon ().

The Smart Filter dialog is displayed:

  1. Specify which rules in the filter must be matched.

  1. Define one or more rules.

To define a rule, select an option in each of the first two logic boxes and then type the criteria in the third box. To add another rule simply click Add Rule.

Note: If you define a rule that does not make sense (for example, "Threat Name is greater than 3") the rule will simply be ignored.

  1. Type a name for the filter.

  2. When you are finished defining your custom filter, click Save/Rename.


Assume you want to see all the quarantined threats in a specific domain. You simply create a filter similar to the following: