Applying a column filter

Administrator Help | Forcepoint DLP | Version 8.8.2

The column filter enables you to apply filters directly to the incident list without accessing the Manage Report menu to build a custom screen.

Column filters further filter the data provided in the incident list. This means that the column filter is applied on top of the main filter—the one created with the Manage Report > Edit Filter option.

For example: If the main filter is set to display only SMTP channel incidents, and the column filter is then set to display severity - high, only high severity SMTP incidents are displayed. Column filters are not saved, so when a custom filter is applied, the column filter that was applied before it is lost.

Selecting the Clear Column Filter option clears the applied column filter and applies the selected main filter.

Arrow buttons on column headers enable users to quickly filter the displayed information. Below are instructions of how to filter the information in the columns.

To filter columns:

Click the down arrow button in a column header. A drop menu with 5 options appears. Different columns display different options.

Select from one of the following options:

Option

Description

Sort Ascending

Sorts the column's entries by A-Z, from top to bottom.

Sort Descending

Sorts the column's entries by Z-A, from top to bottom.

Group by this Column...

Incidents in the incident list screens can be grouped, allowing an alternative filtered report.

Grouping incidents enables deep drill down into a problem. For more information, refer to Grouping incidents.

Filter by this Column...

When this option is selected, a pop-up caption box appears enabling you to filter the column according to specific words or to filter the column to exclude specific words.

In most cases, you can select one of the following options in the Must field:

Contain - Select this option if you want only incidents containing a specific word to appear in the incident list. If an entry in this column contains the word you enter, it appears in the incident list. Entries that do not contain this word do not appear. For example, entering "jon" displays incidents for Mary Jones and Jonathan Smith. Entering "jon" in the Contains field is equivalent to entering "*jon*".

Be equal to - Select this option if you want only incidents that match the word you enter exactly to appear in the incident list. For example, if you enter "jon", incidents for Jon Smith would appear, but those for Jonathan Smith would not.

Be empty - Select this option if you want to display only incidents in which the specified field is empty (contains no value).

The results are displayed in the column with or without the specific words in the column.

Note: When a column is filtered, the header arrow turns blue.

Clear Column's Filter

When this option is selected, all current and previous filters set for the column are cleared.