Contents
Comprehensive filtering of nodes and links
This section contains instructions on comprehensive filtering of nodes and links.
Filtering using a period on the timeline
To filter nodes and links, you can select a time period on the timeline. The timeline is displayed in the lower part of the network interactions map window.
The timeline contains the following elements:
- The starting date and time of the timeline.
- Periods when events with scores of 4.0 and higher were recorded. These periods are displayed as red bars in the lower part of the scale. Periods are not displayed if the configured length of the timeline is more than seven days.
- Filtering period. This period is displayed as a yellow bar with dragging handles at both ends.
- Graph of traffic volume processed by the application. The graph is not displayed if the configured length of the timeline is more than seven days.
- The end of the timeline. Depending on the filtering period, the end of the timeline is displayed as a date and time (if a date and time is specified) or as a Now link.
The following types of filtering periods are possible:
- Period with reference to the current moment. The right end of such a period coincides with the right end of the timeline corresponding to the current moment.
- Period without reference to the current moment. A period of this type can be placed anywhere in the timeline.
To configure filtering of objects by period with reference to the current moment:
- Click the Now button to the right of the timeline. This button is not displayed if the period is already defined with reference to the current moment.
- If you want to specify a different length of the period, do one of the following:
- Drag the left end of the yellow period bar to the required position (the maximum length of period is 7 days).
- Open the settings window by clicking the button above the yellow period bar, select the Anchor to boundary check box, then select a duration (Hour, Day, 7 days) and click OK.
The network interactions map displays only those nodes and connections for which interactions were detected from the beginning of the specified period to the current moment.
To configure filtering by period without reference to the current moment:
- If the period you want to set is out of bounds of the timeline, change the start and/or end date and time of the timeline:
- To change the start date and time of the timeline, click the link in the left part of the timeline to open a window and in that window, select one of the following options:
- Day.
- 7 days.
- 30 days.
- Set the date. For this option, specify a date and time in the displayed field.
- To change the end date and time of the timeline, click the link in the right part of the timeline to open a window and in that window, select one of the following options:
- Now.
- Specify a date. For this option, specify a date and time in the displayed field.
- To change the start date and time of the timeline, click the link in the left part of the timeline to open a window and in that window, select one of the following options:
- Set the period you want. To do so, do one of the following:
- Drag the period on the timeline to where you want it to be.
- Move one or both edges of the yellow period bar on the timeline to where you want the period to be (the maximum length of a period is 7 days).
- Open the settings window by clicking the button above the yellow period bar, then select a duration (Hour, Day, 7 days) and click OK.
- If the period is automatically anchored to the current moment (when you move the period to the extreme right position, the Now button to the right of the timeline is no longer displayed) and you don't want this, disable the automatic anchoring. To do so, open the settings window by clicking the button above the yellow period bar, clear the Anchor to boundary check box and click OK.
Filtering by registered events
On the network interactions map, you can display nodes and links whose information is stored in events associated with the selected nodes.
You can use the filtering functionality if no more than 200 nodes are selected on the network interactions map. You can select nodes either individually or as part of collapsed groups that include the required devices. When you select a collapsed group, all devices in child groups at all nesting levels also end up in the selection.
You can use the following ways of filtering by events:
- Initial filtering by events. Use this method to filter objects by events associated only with the selected nodes.
- Additional filtering by events. Use this method when the initial filtering by events already has been performed (for example, when going to the network interactions map from the table of events) and you need to supplement the filter with events associated with additional selected nodes from among the network interactions displayed on the network interactions map.
To display nodes and links based on initial event filtering:
- On the network interactions map, select one or more nodes and/or collapsed groups.
To select multiple nodes and/or groups, do one of the following:
- Press and hold the SHIFT key, then use the mouse to select a rectangular area with the objects that you want to select.
- Press and hold the CTRL key and click every object that you want to select.
- In the toolbar above the network interactions map, open the Event filter drop-down list.
- In the drop-down list, select Filter.
The network interaction map displays only nodes and links whose information is contained in events associated with the selected nodes. In the toolbar above the network interactions map, a list is displayed with event IDs (the IDs are listed in the chronological order of detection of the associated events).
To add nodes and links to the displayed objects using additional filtering by events:
- Make sure the initial filtering by events already has been performed. To do so, look for the list of event IDs in the toolbar above the network interactions map.
- From among the displayed nodes on the network interactions map, select nodes whose associated events you want to add to the filter.
The details area is displayed in the right part of the web interface window.
- In the toolbar above the network interactions map, open the Event filter drop-down list.
- In the drop-down list, select Add to filter.
The network interaction map additionally displays nodes and links whose information is contained in the events associated with the selected nodes. IDs of detected events are added to the list of IDs in the toolbar.
Page top