Documentation | Support

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
How Do I... > Filter incidents?
Filter incidents?
Administrator Help | Forcepoint DLP | Version 8.7.x
To filter incidents in a report, edit the report filters or apply column filters.
Editing report filters
To change the filters that are applied to a report:
1.
Open the report.
2.
Select Manage Report > Edit Filter in the report toolbar.
3.
Select a filter from the Filter by list, then select Enable filter.
4.
Configure the filter properties, if any.
For example, for the Action filter, indicate which actions to include in the report.
5.
Repeat steps 3 and 4 for each filter that you want to apply.
6.
Click Run.
7.
To save the report for later use, select Manage Report > Save As.
Applying column filters
The incidents list is a table displaying all data loss prevention or discovery incidents. By default, incidents are sorted by time, but the table can be sorted by any of its columns (ascending or descending). You can also group by and filter by columns.
To filter incidents by columns in the incident list:
1.
Click the down arrow button in a column header to see the sort and filter options available. These vary based on the column contents.
2.
Select Filter by this Column to open a dialog box with options for filtering the column. For example:
*
To filter the Source column, select one or more users, computers, or domains to include or exclude.
*
To filter the Channel column, select one or more channels
3.
Click OK to apply the filter.
*
The incident table is updated to show only rows that match the selected filter.
*
An icon appears next to the column header to show that a filter has been applied to that column.
To clear a column filter, click the filter icon in the column header and select Clear Column's Filter.

Go to the table of contents Go to the previous page Go to the next page View or print as PDF
How Do I... > Filter incidents?
Copyright 2020 Forcepoint. All rights reserved.