Setting Event Criteria

In this topic:

How Event Criteria Works

Search for...

Program, Domain, Action, Type

 

 

While General Criteria is similar for all activities (date range, computers, users), Event Criteria varies depending on the type of activity selected. Event Criteria in combination with General/Global Criteria provides the cross-hair view to specific data. Problem areas come into focus, and charts become easier to read.

For example, instead of looking at all Web Site activity for a week, you can filter the recorded data to included only "blacklist" domains. The Dashboard will retrieve just the Web Site events that occurred at the specified domains.

How Event Criteria Works

Event Criteria produces a fine-granularity view of data. The data you see becomes more meaningful as you "filter" events.

When you change the Event Criteria for one chart, report, or form, it does not affect the criteria for other data forms. The criteria will eventually revert to the default settings if you do not select Save Criteria on the General Criteria panel.

Examples:

  • Monitor chat with former employee.
    In a Data Explorer Chat/IM form, set the Event Criteria to search for the former employee's name.

  • Track movement of high-security documents.  
    Modify Event Criteria for a Quick View Document Tracking chart to search for document names and/or paths.

  • Pinpoint unusual usage of bandwidth.
    A Quick View chart alerts you to the problem, and a Data Explorer File Transfer form verifies your suspicion.  General Criteria lets you set a time period to non-working hours, and Event Criteria filters the individual records to protocols (such as Gnutella and Kazaa) and to only "Download" activity.

Search for...

All events (except User Activity and Screen Snapshots) allow you to search for keywords or phrases as criteria. The Dashboard accepts any number of search keywords, up to 99 characters. Keywords are matched against selected fields in event records, such as the URL of a web site. At least one field must match the search criteria before a record is returned as a match. See Event Search Rules for more information searching.

Program(s), Domain(s), Action, Type

Most events let you limit the scope of events to those processed by a specific program or at a specific domain. For example, you can track active time spent on a specific game program. Finally, all events are associated with their own actions (print, download, active program, etc.) and type (protocol for chat, file transfer, email, etc.). Refer to each of the following topics for complete information.

Related Topics

 Chat / IM Event Criteria

Document Tracking Event Criteria

Email Event Criteria

File Transfer Event Criteria

Keystroke Event Criteria

Network Event Criteria

Online Search Event Criteria

Program Event Criteria

Screen Snapshots Criteria

User Activity Event Criteria

Web Site Event Criteria