Using Report Filters

Report filters allow you to display changes matching certain criteria. For example, you can filter changes by audited domain or object type. Filtering does not delete changes, but modifies the report view, allowing you to see changes you are interested in.

For example, you can update report timeframe, select specific values for Who and Where, apply sorting, etc.

Filters can be found in the upper part of the Preview Report page:

To apply filters

  1. Navigate to Reports, select the report you need and click View.
  2. Specify filters to apply to the report, and click View Report.

When applying filters, mind the following:

  • Wildcards are supported.
    For example, if you want to view changes made by users with the name containing "administrator" (e.g., enterprise\administrator, corp\administrator, sqladmin), type %admin% in the Who (domain\user) filter field.
  • escape_characters are not supported.
  • Do not use % in the exclusive filters (e.g., Who (Exclude domain\user)). Otherwise, you will receive an empty report.