Configuring data filter conditions

Use data filter conditions to specify which events will be included in the report. Only the events which match the specified criteria will be processed and presented within the report.

Screenshot 16 - Custom Report Wizard: Filters dialog

Click on the Add… button to bring up the ‘Edit filter properties’ dialog and configure the following conditions:

•	‘Filter condition’ – Specify the data source area on which the filter will focus (for example, select ‘Computer Name’ to filter the events data related to a particular computer).

•	‘Condition’ – Specify the condition comparison parameter.

•	‘Value’ – Specify the string to which source data will be compared.

For example to generate a report which contains only information related to a workstation called “TM_Jason”, configure your filter parameters as shown below:

Screenshot 17 - Filter conditions configuration dialog

For more specific reports, you can limit the range of information to be displayed by tightening your conditions/search criteria. This is achieved by configuring and applying multiple data filters against the selected data source. When more than one filter is used, specify how these filters will be logically linked. This is achieved by selecting a logical grouping condition from ‘Filter property condition…’ drop down list.

•	Select And to include ALL the scan data information that satisfies ALL of the conditions specified in the filters.

•	Select Or to include ALL the scan data information that matches at least one of the specified filter conditions.

Example: Using multiple filters

Consider the situation where a custom report has 2 filters configured as follows:

Screenshot 18 - Using multiple filters

Parameters	Filter 1	Filter 2
Filter condition	Computer Name	User Name
Logical relation	Is equal to	Includes
Value	‘TM_Admin1’	‘Jason’

The data which will be included in this custom report will vary according to how these filters will be applied against your data. This is defined through the ‘Filter property condition…’ drop-down.

Filters applied			Data output
Filter 1	and	Filter 2	The report will show: • All the events by users called ‘Jason’ on the computer called ‘TM_Admin1’.
Filter 1	or	Filter 2	The report will show: • All the events generated by users called ‘Jason’ – (no matter on which computer the connections were made) AND • All events related to the computer called ‘TM_Admin1’ – (no matter who the users are).

Example: Creating a custom report based on data collected during a particular month

This example demonstrates how to generate a failed logon report called ‘Failed logons in July 2006’. This report will be based on the events:

•	Collected from the computer called ‘TM_Admin1’

•	Generated by the user account ‘Jason’

•	Recorded during the month of ‘July 2006’.

To create this report:

1. Click on the Default Reports navigation button.

2. Right-click on the report to be customized and select New > Custom Report. This will bring up the ‘Custom Reports Wizard’.

3. As soon as the welcome dialog is displayed, click Next.

Screenshot 19 – Selecting the data source to use

4. Select the ‘Month’ option and specify the following parameters:

•	Month: ‘July’.

•	Year: ‘2006’.

5. Click on Next to proceed to the data filters dialog.

Screenshot 20 - Filter conditions dialog(s)

6. Click on the Add… button and configure the parameters of filter 1 as follows:

•	Filter condition: ‘Computer Name’

•	Condition: ‘Equal to’

•	Value: ‘TM_Admin1’.

7. Click OK to finalize your filter configuration settings.

8. Click again on the Add… button and configure the parameters of filter 2 as follows:

•	Filter condition: ‘Account’

•	Condition: ‘is equal to’

•	Value: ‘Jason’

•	Filter Property condition…: ‘and’.

9. Click OK to finalize your filter configuration settings.

10. Click Next and specify the following parameters:

•	Report Name: ‘Failed logons in July 2006’

•	Report Title: ‘Failed logons by Jason on computer TM_Admin1’

•	Report Description: ‘This report shows the failed logons made by user Jason Micallef on computer TM_Admin1 during July 2006.’

11. Click Next to proceed to the final dialog.

12. Click Finish to finalize your custom report configuration settings.