Current ThreatQ Version Filter
Status Filters
Status filters allow you to filter advanced search results an object's Status.
Only Events, Indicators, Signatures, and Tasks can be filtered by their Status. In addition, the Event Status filter is displayed only if an administrator has configured Event Statuses in the Object Management page.
Filtering by Status
- Click the Filters dropdown and select <Object Type>Status.
The <Object Type> Status filter row is displayed under the filter set name. - Click the Add Status option to access a drop-down list of statuses.
-
Locate and click the checkbox next to the status for your filter by scrolling through the drop-down list or entering the status in the Search field. You can select one or more user names at a time from this list.
The Event Status filter gives you the option to include events without an status by selecting the None option.
The search results update with the applied filter.