Activity Forensics

The Activity Forensics screen displays all user activities and alerts recorded by the system. Use filters to focus on specific activities, limited to 100,000 results. A detailed view is provided for each activity in the Actions dropdown menu.

Filters

Apply the following filters to retrieve specific results:

• Field/Value

Select a field from the list and set its values. After defining all of the filters, click on "Apply" to retrieve the matched results.

• Time Frame

Define the Time Frame for results. Use one of the Last Period options, or the Advanced Options to create a customized Time Frame.

• Show alerts only

Select the "Show alerts only" checkbox to retrieve only Alerts, created by the Alert Rules.

Columns

Customize the table view:

• Displayed columns

Select the displayed columns in the table, using the Columns dropdown menu.

• Column order

Drag and drop the columns to set the order.

Queries

Save all applied filters, along with the displayed columns, in a Query object for future use.

• Share the Query with other users.
• View all saved and shared Queries in the Query List.
• Click on a Query to load its filters and displayed columns. A Query object cannot be edited, and changes made after loading a Query do not impact the loaded Query object. However, these changes can be saved in a new Query.
• A Query can be deleted only by the user who created it.
• By applying filters, a Query is automatically saved in "Recent". Up to 10 recent Queries are saved, from which the user can load previous Queries.

Reports

Generate a report based on the results of current applied filters.

• Generate Report

Generate a report on demand.

• Schedule Report

Schedule and save a Report Template.

All generated reports are accessible from the Reports > My Reports screen.