Use the Filters to build a list of matching conditions that allows you to customize the records that are displayed in the Report Data tab. This allows you to build reports that show only the information that your users require.
Click Reports on the home page of the console.
Click any of the four types of reports namely, Sessions, Administrator Activities, Credential Checkouts, and Shared Key Checkouts for which you want to view in the navigation pane.
Click Filters.
Select from the following conditions. You can combine conditions with AND logic, which requires the report to match all conditions that have been joined with an AND. You can also combine conditions with OR logic, which requires the report to match either the conditions before the OR or the conditions after the OR.
Authorized: Select this option to use session authorization by the Command Control as a matching criteria. Use the Yes/No drop-down list to specify whether the session matches when the session was authorized or not.
Session Capture: Select this option to use session capture as a matching criteria. Use the Yes/No drop-down list to specify whether the report matches when the session capture was authorized or not.
User: Select whether you want to match on the submitting user or the run user. For the matching type, select one of the following:
Select Matches or Doesn’t Match, then specify an exact value or a value with an asterisk (*) wildcard such as jo*.
Select Regexp or Doesn’t Regexp, then specify a regular expression.
User Domain: Select whether you want to match the domain on the native mapped user or the second factor authenticated user. For the matching type, select one of the following:
Select Matches or Doesn’t Match, then specify an exact value or a value with an asterisk (*) wildcard such as jo*.
Select Regexp or Doesn’t Regexp, then specify a regular expression.
Host: Select whether you want to match on the submitted host or the run host. For the matching type, select one of the following:
Select Matches or Doesn’t Match, then specify an exact value or a value with an asterisk (*) wildcard such as jo*.
Select Regexp or Doesn’t Regexp, then specify a regular expression.
Command: Select whether you want to match on the submitted command or the audited command. An audited command is a command that has been audited within a session capture. Audited commands are collected when the session used the pcksh shell with the audit option. For the matching type, select one of the following:
Select Matches or Doesn’t Match, then specify an exact value or a value with an asterisk (*) wildcard such as jo*.
Select Regexp or Doesn’t Regexp, then specify a regular expression.
Audit ID: Select to match the session on the audit ID assigned to the session. For the matching type, select one of the following:
Select Matches or Doesn’t Match, then specify an exact value or a value with an asterisk (*) wildcard such as 4bd*.
Select Regexp or Doesn’t Regexp, then specify a regular expression.
Session Start: Select to match the session on when it started or when it ended. Select either Session Start or Session End, select After or Before for the matching operator, then use the calendar to specify a date and use the time fields to specify the hour and minute.
Disconnect Type: Select to match based on the Disconnect Type of the session. For the matching type, select one of the following:
Select Matches or Doesn’t Match, then specify an exact value or a value with an asterisk (*) wildcard such as 4bd*.
Select Regexp or Doesn’t Regexp, then specify a regular expression.
(): Select to group conditions so that the record is displayed if it matches the conditions defined by one group in the filter.
Click Apply.