Filter and display of events¶
The Filter and display of events module lets you assign a coloured icon to each type of event reported by CyberElements and to hide events that are not relevant. The configuration is then used by the Control center and other screens that display events, to visually highlight criticality.
An administrator uses it, for example, to emphasise SSH session openings with a red badge or to hide clipboard events entirely if they are not being analysed.
List of existing filters¶
The main grid lists the filters already registered:
| Column | Description |
|---|---|
| (no header) | Icon assigned to the filter. |
| Events type | Event family (see the table below). |
| Keyword | Substring searched within the event content. Empty means "all events of this type". |
| Filter type | Inclusion or Exclusion, preceded by a pictogram. |
A search field in the toolbar filters the grid by substring. The search is applied 700 ms after the last keystroke or immediately on Enter. Bottom pagination (15, 25 or 50 rows per page) handles long lists.
Event families managed, in drop-down order:
| Events type | Covers |
|---|---|
| URL events | URLs opened during a web session. |
| Raised alert events | Alerts raised by the system. |
| Program events | Launching and closing programs. |
| Keystroke events | Captured keystrokes. |
| Clipboard events | Copy/paste. |
| Window events | Window activation and close. |
| File events | File manipulations. |
| SSH command events | Commands typed in an SSH session. |
| SSH display events | Content displayed in an SSH session. |
| Customized event | Events reported by an integration. |
| SFTP transfer events | SFTP transfers. |
| Helpdesk event | Events related to session sharing. |
Add a filter¶
Click + in the toolbar. The Add events filter window opens.
| Field | Description |
|---|---|
| Events type | Mandatory, non-editable drop-down. Pick one of the families above. |
| Filter type | Radio buttons Inclusion (the event is shown) or Exclusion (the event is hidden). Inclusion is checked by default. |
| Keyword | Substring matched against the event content. Optional. |
| Icon | Button that opens a palette of 10 coloured icons. Mandatory. |
Click Validate.
Filter already exists for this type
If a filter is already registered for the same Events type, a confirmation warns that events matching more than one filter can be displayed several times. The filter is added only once the warning is accepted.
Hide an entire event family
To hide a whole event family, create an Exclusion filter on that type with an empty Keyword field.
Edit a filter¶
Select a row then click the Properties icon (or double-click the row). The Edit events filter form is identical to the add form. Changes are saved with Validate.
Delete a filter¶
Select one or several rows then click ×. A confirmation is requested. Multi-selection is supported.