Filtering UEBA logs

You can filter the logs by exact match or with combinations as needed to refine log results to review specific users, Observable and so on as needed.

1. Click into the Search field and you will see a drop-down with the option to select the column you are filtering by.
   
   
   
2. Once you select the column, it will enter that into the box and give you the option to select equals, does not equal, or contains as an option and then will present you with the ability to enter the text for what you are filtering on.

   

   

3. You can apply multiple filters together by using an AND or OR between the filters in the filter search bar.
   
   
   

   Once ready to search, click into the space with the magnifying glass to search or click Search in the top right corner.