12.4 Adding an Incident View

  1. Click the Incidents tab in the Sentinel Control Center.

    For more information, see Section 12.1, Accessing Incidents.

  2. Click the Manage Views drop-down, then select Add View.

  3. Specify a name in the Option Name field. Click each button (listed below) to specify the options.

    • Fields: The variables of the events attached to Incidents are displayed as fields. By default, all the fields are arranged as columns in the Incidents View. You can add or remove columns, and arrange the order of the columns by using the up and down arrows.

    • Group By: Allows you to set rules to group Incidents.

    • Sort: Allows you to set rules to sort the Incidents.

    • Filter: Allows you to set filters. Only Incidents that match the filter are displayed in the Incidents View.

    • Leaf Attribute: Allows you to select attributes from the list, which is displayed as the first column in the Incidents View.

  4. Click Save.