11.5 Viewing Events

11.5.1 Viewing Events Based on Report Criteria

You can view events for the existing report definitions that are loaded in Sentinel or for the report that you create. To view the events, select a report definition and click Search events. Specify the required parameters and click Search. The search results are displayed. For more information, see Section 2.2, Viewing Search Results.

When you schedule a report to run immediately, the results display in the Sentinel interface. You can interact with the results as you would do for any search, such as refining the search or performing an action on the results. For more information, see Section 2.3, Refining Search Results.

11.5.2 Viewing Events Based on Report Result Criteria

The reports are loaded and displayed in the Reports and Searches panel on the left of the Sentinel Web console. Click More options > Show all reports to view all reports, click More options > Show only scheduled reports to view only the scheduled reports, or click More options > Show only unread reports to view the reports that are not read.

The report results for each user varies depending on the data security settings configured for the role of that user. All the report results are ordered by the creation time. If there is more than one report, the Show more link is displayed that displays other report results.

In the Reports and Searches panel, the report definitions show the number of unread reports with a blue dot next to them. If you have grouped the report definitions by category, the category title shows the number of unread reports under that category.

A blue dot next to the report result indicates that the report result is unread. For more information, see Marking Report Results as Read or Unread.

Viewing the Report Results in PDF

The scheduled report results are saved as PDF. To view the report results, select the report result in the Reports panel, and then click View PDF. Select the PDF reader and click OK. Report results are organized from the newest to the oldest. The bottom of the PDF displays the parameter values used to run the report.

The Reports and Searches panel on the left side of the page displays a status pane at the bottom left corner of the page. The status pane displays the parameter information or the schedule information associated with the selected report. It also displays the error messages, if the report execution resulted in an error.

To view the sample report to find out how the completed report looks, click the sample report, and then click View report PDF.

11.5.3 Finding Reports Based on Words

You can find a report based on words in the report definition. In the Reports and Searches panel, specify the words for which you want to search in the Find field. The search is based on the individual words. For example, if you specify Audit Trail, Sentinel displays all reports that have Audit or Trail in the report definition title.

11.5.4 Finding Reports Based on Tags

If you have tagged report definitions, you can find reports based on tags by clicking Tags next to the Find field. Select the tags on which you want to search the reports, and then click Find. The Reports and Searches panel displays only those reports that are associated with the selected tag. For associating a report with a tag, see Section 11.9, Associating Tags with Report Results and Report Definitions.