Viewing event streams
Refer to these instructions to view event streams.
How to view event streams
- In the FortiDLP Console, on the left-hand sidebar, click
. - Remain in the Event streams tab.
By default, all events for the current day are aggregated. - Optionally, to filter events by using the search bar and/or a time range, see Performing Investigate searches.
If the search query matches events from an event stream, the event stream panel will be highlighted in blue.
- Select an event stream panel.
- Optionally, do the following:
- To show/hide the sections shown on the page;
- At the top-right corner of the page, click Page view.
- Select a section checkbox to show it, or deselect it to hide it.
- At the top-right corner of the page, click Page view.
- To modify aggregations, in the Aggregations section, do the following:
- To modify the layout of aggregations, click Grid or Strip.
These settings are applied if your screen size is not large enough to fit all aggregations. Grid will display aggregations in two or more rows, and Strip will display them in one scrollable row. - To modify the information displayed in an aggregation widget, click a menu and select a new value. Top menu options show the most common values for a property and Bottom menu options show you the least common values.
- To create an aggregation:
- Click Add.
- In the new aggregation widget, select a term and optionally a Top or Bottom value.
- To delete an aggregation, at the top-right corner of an aggregation widget, click
> Delete.
- To modify the layout of aggregations, click Grid or Strip.
- To modify the events table, in the Events section do the following:
- To modify the table columns:
- To make a custom selection, click Columns and select/deselect checkboxes.
- To create a default selection that can be used in future login sessions:
- Click Columns and select/deselect the relevant checkboxes.
- Click Set new default.
- Select the My default radio button to use the selection.
- To change the number of events shown in the table, change the Items/page default. You can show 50, 100, or 500 events on the page.
- To modify the table columns:
- To filter the events by a specific value on the page or view more information about a value, click the value and then click the relevant context box button.
The following list summarizes the buttons that display:
Filters the current page for events with the same value.
Filters the current page for events without the value.
Filters by a value within the SaaS apps module's Inventory tab.
Copies a value to your clipboard.
Displays more information about a value.- Displays a submenu containing the following options:
Filters by a value within the Users module.
Filters by a value within the Nodes module (if selected from a user's context box) or takes you to the Node profile page (if selected from a node's context box).
- To filter the page for events occurring before, after, or around the same time as an event in the table, click the timestamp and set your preferred time range.
For example, selecting 10 minutes and the Around menu option would filter for events occurring during the 10 minutes before the timestamp and the 10 minutes after the timestamp.
- To view an event more closely in the Event details panel, click the event’s table row.
- To show/hide the sections shown on the page;