Add identity provider activity data to a filter

You can add specific data from the Identity Provider Activity report to a filter.

You must be an ETP super administrator or a user with a specific permission to view this report. For more information, see Enterprise Threat Protector roles.

How to

  1. Make sure that you are on the Identity Provider Activity tab of the Activity page. To go to the identity provider activity report, select Monitoring > Activity. Click the Identity Provider Activity tab
    Note: If you are trying the new Enterprise Center interface, in the navigation menu, select Threat Analytics > Activity > Identity Provider Activity.
  2. Click the data value that you want to add to the filter. For example, if you want to add a location, click the location.
  3. Select one of the following:
    • If you want the data to be part of the In filter, select Add to Include Filter. A value cannot be added to the Include Filter if it’s already in the Exclude Filter.
    • If you want the data to be part of the Not In filter, select Add to Exclude Filter. A value cannot be added to the Exclude Filter if it’s already in the Include Filter.