Go Up
You are here: IntelligenceReports and Report PacksPredefined ReportsLeverage Filtering Capabilities

Leverage Filtering Capabilities

Report filters allow you to display changes matching certain criteria. For example, you can filter changes by audited domain or object type. Filtering does not delete changes, but modifies the report view allowing you to see changes you are interested in. Filters can be found in the upper part of the Preview Report page.

To apply filters

  1. Navigate to Reports and generate a report.
  2. Apply filters to the report and click View Report. For example, you can update report timeframe, select specific values for Who and Where, apply sorting, etc.

Wildcards are supported. For example, type %admin% in the Who (domain\user) field if you want to view changes made by users with the name containing "administrator" (e.g., enterprise\administrator, corp\administrator, sqladmin).

Do not use % in the exclusive filters (e.g., Who (Exclude domain\user)). Otherwise, you will receive an empty report.

NOTE: escape_characters are not supported.

The example below applies to the All Changes by Server report and shows the before and after views of the report. The filters may vary slightly depending on the data source and report type.

The report without filtering:

The report below displays changes made by enterprise\administrator (the Who filter is set to "enterprise\administrator") that affected users (the Object type is set to "user") across all data sources, records are sorted by the action.

Go Up