Add or remove data columns to events tables

You can add or remove data that appears in an events table. The modifications you make to an individual table apply to all events tables you view for an event type. For example, if you make a modification to a threat event table, all threat events tables show the new table columns.

If Enterprise Security Connector is configured for your organization, the modifications you make for a security connector event applies to all Security Connector events.

How to

  1. For threat or AUP events, in the navigation menu, select Monitoring > Events. Depending on the type of events you want to view, click the Threat Events or the AUP Events tab.
    Note: If you are trying the new Enterprise Center interface, in the navigation menu, select Threat Analytics > Events. Select the event type.
  2. For Security Connector events, in the navigation menu, select Monitoring > Activity. Click the Security Connector tab.
    Note: If you are trying the new Enterprise Center interface, in the navigation menu, select Threat Analytics > Activity > Security Connector.
  3. Filter events as needed. For more information see Filter data based on date and time and Filter event data.
  4. If you haven’t done so already, select a dimension or event criteria.
  5. To add a data column to the events table:
    1. In the grouped events area of the page, click the table icon. A list of data types appear.
    2. Select the data type that you want to add to the table. A column for this data appears.
  6. To remove a data column from the events table:
    1. In the grouped events area of the page, click the table icon. A list of data types appear.
    2. Deselect any data type that you want to remove from the table. After a data type is deselected, the column is removed from the events table.