If you are a Cisco Security Analytics and Logging customer, you can create and save custom filters that you use frequently.
The elements of your filter are saved to a filter tab as you configure them. Whenever you return to the Event Logging page, these searches will be available to you. They will not be available to other CDO users of the tenant. They will not be available to you on a different tenant, if you manage more than one tenant.
Note: Be aware that when you are working in a filter tab, if you modify any filter criteria, those changes are saved to your custom filter tab automatically.
Create and Save a Custom Filter
- From the main menu, select Monitoring > Event Logging.
- Clear the Search field of any values.
- Above the event table, click the blue plus button to add a View tab. Filter views are labeled "View 1", "View 2", "View 3" and so on until you give them a name.
- Select a view tab.
- Open the filter bar and select the filters attributes you want in your custom filter. See Searching for and Filtering Events in the Event Logging Page. Remember that only filter attributes are saved in the custom filter.
- Customize the columns you want to show in the event logging table. See Show and Hide Columns on the Event Logging Page for a discussion of showing and hiding columns.
- Double-click the filter tab with the "View X" label and rename it.
- (Optional) Now that you have created a custom filter, you can fine tune the results displayed on the Event Logging page, without changing the custom filter, by adding search criteria to the Search field. See Searching for and Filtering Events in the Event Logging Page.
- (Optional) Download the results of your custom filter to a .csv.gz for further sorting and analysis. See Downloading Events.