# Analyze log, alert, and audit entries

The Log Analysis view provides various tools to analyze logs, alerts, and audit entries.

##

For more details about the product and how to configure features, click Help or press F1.

## Steps

1. Select Logs.
2. Select Analyze.

## Log Analysis view

Use this view to analyze log data.

Option | Definition
--- | ---
Toolbar
Stop | Aborts the running query.
Save | Saves a snapshot of entries.
Columns | Column Selection — Opens the Column selection dialog box. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.
Aggregate | Sort by Column — Sorts the log data by column type. Aggregate by Service — Combines the log data by Service. Aggregate by Situation — Combines the log data by Situation.
Statistics menu | Shows the monitored data as charts. Select one of the predefined statistical items or select Select to create a custom statistical item.
Visualizations | Attack Analysis — Displays information in Situations of the type Attack or Successful Attack. Audit Map — Displays information about how users manipulate elements. Application and Executable Usage — Shows users and the applications that they use and access. Indicates allowed and disallowed connections between users and applications. Service Map — Displays access to services in the network.

Option | Definition
--- | ---
Log entry table — Several menu options are available when you select a log entry and right-click.
Whois | Looks up the selected IP address in the online Whois database.
New Host | Opens the Host Properties dialog box that allows you to create a Host element using the IP address in the log entry.
Details | Shows the Details view of the selected record.
Logs by Record | Returns from the Log Analysis view to the Logs view.
Tools | Copy — Copies the entry details to the clipboard.
View Rule | Views the rule that generated the log entry (if applicable).
Add Filter: <field name> | Adds the item and its value as a new filter row in the Query pane.
Filter: <field name> | Opens the Filter Properties dialog box that allows you to create a Filter element.

Option | Definition
--- | ---
Query pane — Allows you to filter the records displayed in the Logs view.
Query drop-down list | Select a Log Data Context to limit the type of log data that it displayed. To select a Log Data Context that is not in the list, select Select. To create a Log Data Context, select New.
New | Adds a filter to the Filter list.
Save | Saves the changes.
Time limit drop-down list | No Limit — All logs are queried. Custom — Define a custom time period from which log entries are queried.
Open Calendar | Select the dates from where you want to query data.
Apply | Retains and applies your changes.

Option | Definition
--- | ---
Fields pane
Category drop-down list | Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field | The name of the field.
Value | The value in the field.