Creating custom views

To create a custom view:

1. Go to Incidents & Events > Event Monitor.
2. Go to an existing view to copy.
3. Add filters that you want to include in the custom view.
   
4. Click the custom view icon in the toolbar.
5. Enter a name for the custom view and assign it to one of the following categories:
   • By Endpoint
   • By Threat
   • System Events
   • Custom View

     

6. Use the Public toggle to toggle the custom view visibility.
   • Enabled: Others can see this custom view displayed in Incidents & Events > Event Monitor > Custom View.
   • Disabled: Only you can see this custom view displayed in Incidents & Events > Event Monitor > Custom View.
7. Select OK to save the view.
   

   When upgrading from versions prior to 6.2.0, existing custom views will be placed in the Custom View category.

To edit a custom view:

1. If using ADOMs, ensure that you are in the correct ADOM.
2. In the navigation, go to Incidents & Events > Event Monitor > Custom View.
3. From the view dropdown, select the custom view to edit.
4. From the view dropdown, select Edit.

   To delete the custom view, you can select Delete.

5. In the Edit Custom View pane, configure the Name, Category, and Public visibility.
6. Click OK to save the changes.