Filter 'Alerts Displayed' Logs
- Click 'More' on the 'CAV' home screen
- Click 'View Logs' > 'Other Logs > 'Alerts Displayed'
- You can create custom views of all logged events
To configure Advanced Filters for Antivirus events
- Select ‘View Logs' > under ‘Other Logs’, select ‘Alerts Displayed’.
- You have 7 categories of filter that you can add.
- Each of these categories can be further refined by either selecting or deselecting specific filter parameters or by the user typing a filter string in the field provided.
- You can add and configure any number of filters in the 'Advanced Filter' dialog.
Following are the options available in the 'Add' drop down menu:
-
Advice:
- The 'Advice' option enables you to filter the alerts based on recommendations given by CAV in the alert.
- Selecting the 'Advice' option displays a drop-down field and text entry field.
-
Select 'Contains' or 'Does Not Contain' option from the drop-down menu.
-
Enter the text or word as your filter criteria.
For example, if you choose 'Contains' option from the drop-down and enter the phrase 'you can safely allow this request' in the text field, then only the entries containing 'you can safely allow this request' in the 'Advise' column will be displayed.
ii. Answer:
- The 'Answer' option enables you to filter the alerts based on how you answered for the alerts.
- Selecting the 'Answer' option displays a drop-down box and a set of specific filter parameters that can be selected or deselected.
-
Select 'Equal' or 'Not Equal' option from the drop down menu. 'Not Equal' will invert your selected choice.
-
Now select the check-boxes of the specific filter parameters to refine your search. The parameter available are:
- Unknown
- Allow
- Deny
- Treat As
- Time-out
- Disinfect
- Quarantine
- Skip Once
- Add to Exclusions
- Add to Trusted Files
- False Positive
- Skip
- Terminate
For example, if you choose 'Equal' from the drop-down and select 'Add to Exclusions' checkbox, only the log of Antivirus alerts for which you answered as 'Ignore' > 'Ignore and Add to Exclusions' will be displayed.
iii. Answered: The 'Answered' option enables you to filter the log based on the date you answered the alerts. Selecting the 'Answered' option displays a drop-down box and date entry field.
-
Select any one of the following option the drop-down box.
- Equal
- Not Equal
-
Enter the date by selecting it from the calendar displayed by clicking the drop-down arrow.
For example, if you select 'Equal' from the drop-down and select '06/14/2015', only the log of alerts answered on 06/14/2015 will be displayed.
iv. Description: The 'Description' option enables you to filter the log based on the description of the attempt displayed in the alert. Selecting the 'Description' option displays a drop-down field and text entry field.
-
Select 'Contains' or 'Does Not Contain' option from the drop-down menu.
-
Enter the text or word as your filter criteria.
For example, if you select 'Contains' from the drop-down and enter 'connect to the internet', only the log entries of antivirus alerts that contain the phrase 'connect to the internet' in the description, will be displayed.
v. Flags: The 'Flags' option enables you filter the entries based on the flags set for the kinds of actions against the event triggered by the file. Selecting the 'Flags' option displays a drop down menu and a set of specific filter parameters that can be selected or deselected.
-
Select 'Equal' or 'Not Equal' option from the drop down menu. 'Not Equal' will invert your selected choice.
-
Now select the check-boxes of the specific filter parameters to refine your search. The parameter available are:
- Remember
- Restore Point
- Submit
- Trusted Publisher
For example, if you choose 'Equal' from the drop-down and select 'Remember' from the checkbox options, only the log entries of alerts for which 'Remember my answer' option was selected will be displayed.
vi. Treat As: The 'Treat As' enables you to filter the log entries based on their 'Treat As' response you entered in the pop-up alert. Selecting the 'Treat As' option displays a drop-down menu and text entry field.
-
Select 'Contains' or 'Does Not Contain' option from the drop-down menu.
-
Enter the text or word as your filter criteria
For example, if you have chosen 'Contains' from the drop-down and entered 'Installer' in the text field, only the log entries containing the phrase 'Installer' in the 'Treat As' column will be displayed.
vii. Type: The 'Type' option enables you to filter the entries based on the component of CAV that has triggered the alert. Selecting the 'Type' option displays a drop down menu and a set of specific alert types that can be selected or deselected.
-
Select 'Equal' or 'Not Equal' option from the drop down menu. 'Not Equal' will invert your selected choice.
-
Now select the check-boxes of the specific filter parameters to refine your search. The parameter available are:
- Antivirus Alert
- Execution Alert
For example, if you select 'Equal' from the drop-down and select 'Antivirus Alert' checkbox, only the log of Antivirus alerts will be displayed.
- You can add more filter types in the 'Advanced Filter' pane by clicking the button at the top right of the filter pane.
- You can also remove a filter type by clicking the button at the top right of the filter pane.
The filters to be applied to the
Antivirus log viewer. Only those entries selected based on your set
filter criteria will be displayed in the log viewer.