Self-service search

The self-service search feature enables you to find and filter user events received from the data sources. You can explore the underlying user events and its attributes. These events can help you identify any data issues and troubleshoot them. The search page displays various facets (dimensions) and metrics available for a data source. You can define your search query and apply filters to view the events that match your defined criteria.

Currently, self-service search is only available for the following data sources:

You can access the self-service search by using the following options:

  • Top bar: Click Search on the top bar to directly go to the search page.

  • Risk timeline on a user profile page: Click Event Search to access the search page and view the events corresponding to the user’s risk indicator and the data source.

Self-service search from the top bar

  1. Click Search to view the self-service page.

    Top bar search

  2. Select the data source to view the corresponding events.

    Top bar search page

Self-service search from the risk timeline on the user profile page

When you select a risk indicator from a user’s timeline, the risk indicator information section is displayed in the right pane. Click Event Search to view the user event on the self-service search page.

Note

Currently, the Event Search option is only available for the Access Control, Content Collaboration, and Virtual Apps and Desktops risk indicators.

Risk timeline search

For more information on the user risk timeline, see Risk timeline.

Use the following features on the self-service search page:

Search explore

Use facets to filter events

Facets are the summary of data points based on the data source. Use the facets to search and filter the user events. For more information on the facets corresponding to the data source, see the dedicated self-service search topics.

Use search query in the search box to filter events

When you place your cursor in the search box, the search box gives you a list of search suggestions based on the selected data source. Use the search suggestions to define your search criteria and find the events.

For example, in self-service search for access, when you place the cursor in the search box, you get the list of dimensions for the access events. Specify your query by using the dimensions, select the time period, and then click Search.

Search query

You can also use the following operators in your search queries.

Operator Description Example Output
: Assign a value to the search query User-Name : John Displays events for the user John
= Assign a value to the search query User-Name = John Displays events for the user John
~ Search similar values User-Name ~ test Displays events having similar user names
”” Enclose values separated by spaces User-Name = “John Smith” Displays events for the user John Smith
<, > Search for relational value Data Volume > 100 Displays events where data volume is greater than 100 GB
AND Search values where both conditions are true User-Name : John AND Data Volume > 100 Displays events of user John where data volume is greater than 100 GB
* Search values that match the character zero or more times User-Name = John* Displays events for all user names that begin with John
    User-Name = *John* Displays events for all user names that contain John
    User-Name = *Smith Displays events for all user names that end with Smith

For more information on how to specify your search query for the data source, see the dedicated self-service search topics.

Select time to view event

Select a preset time or specify a custom time range to view the events and time line details. Click Search to view the events for the selected time period. By default, the selected time period is the last one month.

Time selection

View the timeline details

The timeline details give a graphical representation of the user events for the selected time period. Move the selector bars to choose the time period and view the events corresponding to the selected time period.

The figure shows timeline details for access data.

Timeline details

For example, you want to view the events that have occurred between July 08, 2019 to July 10, 2019. Use the selector bars to select the required timeline area and view the events corresponding to the selected area.

Selector bar

View the event

You can view the detailed information about the user’s event. Click a user to get insight into the user’s data.

The figure shows the user’s details for access data.

Events

Add columns in the event list

You can also add columns and select the data points that you want to view in the event list.

For example, if you want to add columns in the event list for the access data source, do the following:

  1. Click + to add columns for the data points that you want to view on the event list.

    Add more events

  2. In the Add Column window, select the data point that you want to view and click then Add Columns.

    Add columns

  3. If you deselect a data point from the list, the corresponding column is removed from the event list. However, you can view the data point in the event row for a user. For example, if you deselect the TIME data point from the Add Column list, the TIME column is removed from the event list. To view the time record, expand the row for a user.

    Hidden attributes

Export the events to a CSV file

You can also export the searched events to a CSV file and save for future use. Click Export to CSV format to export and download the CSV file that is generated.

CSV export