4.0 Configuring Filters

The Filters feature in Sentinel allows you to customize the event search and prevent data overload. You can save a search query as a filter and reuse it as required, so you can perform a search by selecting the filter rather than specifying the query manually every time.

You can reuse filters while using or configuring Sentinel features, such as:

  • Configuring Data Synchronization

  • Configuring a Data Retention policy.

  • Configuring the data visibility settings for a role.

  • Creating dashboards.

  • Configuring event routing rules.

  • Viewing real-time events in Event Views.

Sentinel provides a list of filters by default. You can also create your own filters. To view the Filters available in Sentinel, click Filters in the left navigation panel.

  • My Filters: Lists the default filters and the filters you created.

  • Shared Filters: Lists the filters that other users have shared with you.

To view events based on filters, select the desired filter. The associated events are displayed in the search results panel.