Skip to main content
The Protect filter bar sits above the event tables and limits rows by date, people, actions, triggers, and status. The same controls apply whether you are on Threat events or Enforcement events, with options that match the active tab’s columns.

​
Overview

Filters reduce noise when you are investigating a user, a time window, or a specific outcome. They work together: multiple criteria combine so only rows matching all selected filters remain visible. After filtering, you can still expand rows for full event or enforcement detail. For what each tab shows, see Threat events and Enforce events.

​
Available Filters

Filter chips or dropdowns typically include Date Range, User, Action, Trigger, and Status. The exact set may vary slightly by tab; for example, threat-focused dimensions align with threat columns, while enforcement dimensions align with enforcement columns.
Filters

​
Date Range

Restricts events to a chosen interval (preset or custom, depending on your UI). Use this first when reviewing incidents or compliance questions tied to a specific period.

​
User

Limits rows to one or more named users. Helpful when following up on a single account or comparing activity for a small set of people.

​
Action

On the enforcement tab, filters by enforcement type (for example self-policing or escalations). On the threat tab, analogous dimensions may appear under different labels tied to threat metadata.

​
Trigger

Shows only events whose actions were started in a particular way (for example manual vs automated), when that field exists on the current view.

​
Status

For enforcement rows, filters by Succeeded, Failed, Pending, or equivalent values so you can focus on incomplete or failed runs.

​
Applying Filters

Open each filter control, select values, and confirm or apply as the UI indicates. The table updates immediately or after you dismiss the panel, depending on the control pattern. You can stack filters across dimensions; the list always reflects the intersection of your choices.

​
Clearing Filters

Use Clear All to remove every active filter and restore the full default time range and audience for that tab. You can also clear filters individually from each dropdown if you only want to widen one dimension.

​
Searching Events

The search bar (when present) matches text across fields exposed for search on the current tab—such as user name, source labels, or action names. It is additive to dropdown filters: both search text and facet filters apply together. If a row disappears after typing, remove or relax filters to confirm whether the match is excluded by a facet, not by the query string.