The Events tab provides a play-by-play timeline of all events related to the searched Entity.
The Events tab contains 4 tabs, each displaying a different type of event:
All Events - this tab displays all types of events in one consolidated timeline view.
Logins - this tab displays only login events related to the searched entity.
Network Connections - this tab displays only network connection events related to the searched entity.
Files - this tab displays only file events related to the searched entity.
Process Creations - this tab displays only process creation events related to the searched entity.
Common actions
You can perform several actions on the tabs located under the Events tab. These actions are repetitive across all of the tabs under the Events section, with slight variations.
Change time range
Use the time range field to limit the results to events that happened in a specific time window. You can select from a predefined list of time windows (Last 6 hours, Last 12 hours, etc.) or define a custom time range.
Organize tabs
Click the … icon next to the tabs to display a list. You can reorder the tabs by clicking the :: icon to grab and drag the tab up or down the list.
Filter results
Use the Filters panel, on the left side of the table, to include or exclude specific information. Each tab will show a different set of filters.
Shift to another event type
To investigate across event types you can use the Shift to option. When investigating events of a specific type, you can pivot to a different event type to view events that happened at the same time, or close to it, under a different event type. Clicking the Shift to option will place you in the selected tab at the nearest time to the event you’re pivoting from.
For instance, if you are inspecting File events and want to learn which login events happened at the same time as the file event, you can click Shift to another event type and then select the event type you want to view.
Upon selecting the desired event type, the relevant tab will open and a marker will be placed in the adjacent time.
Open event details
Click the Event details icon to open a side panel with more details about the event.
