About Simple Filters

Before your first use of the Query Design wizard or the Profile Design wizard, become familiar with the simple filter types.

Examples of Simple Filters

An example of each type of simple filter follows:

Filter type	Value	Description
Ideal Model	Antivirus	Displays only event data that products such as the following generate: CA Anti-Virus McAfee VirusScan Symantec Antivirus Corporate Edition TrendMicro OfficeScan
Event Category/ Event Class	System Access/ login activity	Displays only event data related to users logging in to a system.
Event Log Name	Cisco PIX Firewall	Displays only event data that Cisco PIX Firewall devices generate.

Filter type

Value

Description

Ideal Model

Antivirus

Displays only event data that products such as the following generate:

Event Category/

Event Class

System Access/ login activity

Displays only event data related to users logging in to a system.

Event Log Name

Cisco PIX Firewall

Displays only event data that Cisco PIX Firewall devices generate.

With the exception of Event Log Name, the filter types are based on the Common Event Grammar (CEG).

To learn about product technology-based filters, see the Ideal Models List.
To learn about product category/class/action-based filters, see the Event Categories List and the Event Classes List.

Find these lists in the online help under the "Common Event Grammar" section.