Analyze log, alert, and audit entries

The Log Analysis view provides various tools to analyze logs, alerts, and audit entries.

Steps

Select Logs.
Select Analyze.

Log Analysis view

Use this view to analyze log data.

Option	Definition
Toolbar
Stop	Aborts the running query.
Save	Saves a snapshot of entries.
Columns	Column Selection — Opens the Column selection dialog box. Reset to Default Settings — Discards changes to the column selection and reverts to the previously saved default settings.
Aggregate	Sort by Column — Sorts the log data by column type. Aggregate by Service — Combines the log data by Service. Aggregate by Situation — Combines the log data by Situation.
Statistics menu	Shows the monitored data as charts. Select one of the predefined statistical items or select Select to create a custom statistical item.
Visualizations	Attack Analysis — Displays information in Situations of the type Threats or Suspicious Traffic. Audit Map — Displays information about how users manipulate elements. Application and Executable Usage — Shows users and the applications that they use and access. Indicates allowed and disallowed connections between users and applications. Service Map — Displays access to services in the network.

Option	Definition
Log entry table — Several menu options are available when you select a log entry and right-click.
Whois	Looks up the selected IP address in the online Whois database.
New Host	Opens the Host Properties dialog box that allows you to create a Host element using the IP address in the log entry.
Details	Shows the Details view of the selected record.
Logs by Record	Returns from the Log Analysis view to the Logs view.
Tools	Copy — Copies the entry details to the clipboard.
View Rule	Views the rule that generated the log entry (if applicable).
Add Filter: <field name>	Adds the item and its value as a new filter row in the Query pane.
Filter: <field name>	Opens the Filter Properties dialog box that allows you to create a Filter element.

Option	Definition
Query pane — Allows you to filter the records displayed in the Logs view.
Query drop-down list	Select a Log Data Context to limit the type of log data that it displayed. To select a Log Data Context that is not in the list, select Select. To create a Log Data Context, select New.
New	Adds a filter to the Filter list.
Save	Saves the changes.
Time limit drop-down list	No Limit — All logs are queried. Custom — Define a custom time period from which log entries are queried.
Open Calendar	Select the dates from where you want to query data.
Apply	Retains and applies your changes.

Option	Definition
Fields pane
Category drop-down list	Watchlist — Allows you to create a customized list of fields to show in entries. All — Allows you to view all fields in entries.
Field	The name of the field.
Value	The value in the field.