Customize the Events View

Any changes made to the Event Logging page are automatically saved for when you navigate away from this page and come back at a later time.

Note

The Live and Historical events view have the same configuration. When you customize the events view, these changes are applied to both the Live and Historical view.

Show or Hide Columns

You can modify the event view for both live and historical events to only include column headers that apply to the view you want. Click the column filter icon located to the right of the columns, select or deselect the columns you want, and then click Apply.

Show or Hide Columns
Screen capture of Customize Table pane

Columns with asterisks are provided within the event table by default, although you can remove them at any time.

Search and Add Columns

You can search for more columns, which are not part of the default list, and add them to the event view for both live and historical events. Note that adding many columns for customizing the table may reduce performance. Consider using fewer columns for faster data retrieval.

Alternatively, click the + icon next to an event to expand it and view the hidden columns. Note that some of the event fields displayed when you expand an event can have a different name compared to the corresponding column name. To correlate the events fields displayed when you expand an event to the corresponding column name, see Correlate Threat Defense Event Fields and Column Names.

Reorder the Columns

You can reorder the columns of the Events view. Click the column filter icon located to the right of the columns to expand the list of selected columns and manually drag and drop the columns into the order you want, where the column at the top of the list in the drop-down menu is the left-most column in the Event View.