Administration Guide › Filters and Profiles › Global and Local Filters › Set a Simple Filter

Set a Simple Filter

You can set simple filters to establish criteria for the event data you want displayed or reported. When set in the Query Design wizard, simple filters let you limit the event data returned by a query used in a report or alert. When set in the Profile Design wizard, simple filters limit the data displayed in the report or query results when the profile is applied.

1. Open the wizard.
2. Determine the type of simple filter to set:
   • technology-based.
   • category-based, category and class-based, or category, class, and action-based.
   • product-based.
3. To set a technology-based filter, click the Ideal Model is check box and then select a value from the Ideal Model drop-down list.
4. To set a filter based on a security event category, category and class, or category, class, and action, do the following:
   1. Click the Event Category is check box and then select a value from the associated drop-down list.
   2. (Optional). Click the Event Class is check box and then select a value from the drop-down list.
   3. (Optional). If you selected Event Class, click the Event Action is check box, and then select a value from the drop-down list.

   Note: You can also set this type filter under a technology-based filter.

5. To set a product-based filter, click the Event Log Name is check box and then select a value from the drop-down list.
6. Complete the wizard.