Feature #7706
Updated by Jakub Judiny 3 months ago
Now there are fixed fields displayed in the event search (detected at, sources, severity, category, detector and abuse group). But it could be useful to allow users to choose which fields (e.g. description, port, protocol) should be displayed there instead - this could be helpful when searching for something specific, that cannot be specified through our form.
Based on input from Pavla Hlučková.
Example use cases:
- Searching for events, that do not have "Test" category.
- Searching for events of particular event class (or category), that are from other detectors than "detector1". This can be useful when trying to correctly set parameters of an event class, because you want to see events from all different detectors that send events labelled with this event class.
- Searching for events that do not have a specific description.