Extended filter format in report templates

In Kaspersky Security Center 13.1, you can apply the extended filter format to a report template. The extended filter format provides more flexibility in comparison with the default format. You can create complex filtering conditions by using a set of filters, which will be applied to the report by means of the OR logical operator during report creation, as shown below:

Filter[1](Field[1] AND Field[2]... AND Field[n]) OR Filter[2](Field[1] AND Field[2]... AND Field[n]) OR... Filter[n](Field[1] AND Field[2]... AND Field[n])

Additionally, with the extended filter format you can set a time interval value in a relative time format (for example, by using a "For last N days" condition) for specific fields in a filter. The availability and the set of time interval conditions depend on the type of the report template.

Converting the filter into the extended format

The extended filter format for report templates is supported only in Kaspersky Security Center 12 and later versions. After conversion of the default filter into the extended format, the report template becomes incompatible with Administration Servers on your network that have earlier versions of Kaspersky Security Center installed. Information from these Administration Servers will not be received for the report.

To convert the report template default filter into the extended format:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the required report template.
4. In the context menu of the selected report template, select Properties.
5. In the properties window that opens, select the Fields section.
6. In the Details fields tab click the Convert filter link.
7. In the window that opens, click the OK button.

   Conversion into the extended filter format is irreversible for the report template to which it is applied. If you clicked the Convert filter link accidentally, you can cancel the changes by clicking the Cancel button in the report template properties window.

8. To apply the changes, close the report template properties window by clicking the OK button.

   When the report template properties window opens again, the newly available Filters section is displayed. In this section you can configure the extended filter.

Page top

Configuring the extended filter

To configure the extended filter in the report template properties:

1. In the console tree, select the node with the name of the required Administration Server.
2. In the workspace of the node, select the Reports tab.
3. In the list of report templates, select the report template that was previously converted to extended filter format.
4. In the context menu of the selected report template, select Properties.
5. In the properties window that opens, select the Filters section.

   The Filters section is not displayed if the report template was not previously converted to extended filter format.

   In the Filters section of the report template properties window you can review and modify the list of filters applied to the report. Each filter in the list has a unique name and represents a set of filters for corresponding fields in the report.

6. Open the filter settings window in one of the following ways:
   • To create a new filter, click the Add button.
   • To modify the existing filter, select the required filter and click the Modify button.
7. In the window that opens, select and specify the values of the required fields of the filter.
8. Click the OK button to save changes and close the window.

   If you are creating a new filter, the filter name must be specified in the Filter name field before clicking the OK button.

9. Close the report template properties window by clicking the OK button.

   The extended filter in the report template is configured. Now you can create reports by using this report template.

Page top