Expand possible event detail fields for use as query filters

Products Threat Manager Ideas
, ,
1

What is a one sentence summary of your feature request?

More Event Details fields in query filtering

Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.

When creating a new investigation, not all fields visible in the event details are available for use as filters in creating queries.

For example its not possible to query over:
Originating Client Protocol, Client IP, Host IP and more.

How do you currently solve the challenges you have by not having this feature?

Was not able to find workaround for lack of this functionality.

2

Hi Bartłomiej! Thanks for joining the community.

Can you just verify which version of the product you are on? Also, you included the three fields as examples - are there others you could see yourself wanting or needing to query?

Thanks!