Skip to main content

DashboardDashboards Guide

Table of Contents

Include Context Filtering in Visualizations

When configuring filters for a visualization, you can select up to two context tables and filter on a specific value from a field in each table. To apply context filters to your visualization, use the + Context Filter option at the bottom of the Query Filters panel and you will be able to select a context table from a list of existing context tables. The filter query will perform a data type validation between the field you filter on and the content within the selected context tables.

For more information about configuring and using context filters in a visualization, see the following sections below:

For more information about configuring visualization filters in general, see Configure Visualization Query Filters.

Note

Context table names are used instead of table IDs, so a saved search will stop working if it uses a context table, and that table is renamed.

Limitations for Using Context Filters

The following limitations and rules apply when using context tables in a visualization:

  • You cannot use a context table that has more than 100,000 rows. If a context table is larger than this, it will not show up in the context table list, available for selection.

  • Only custom and filtered context tables can be used in a visualization.

  • There must be at least one entry in the context table before it will be selectable in the visualization query filter.

  • Context table lookup is only available for fields that are of a string-like type (string, ip, email, etc.) or number type (number, integer). It is not available for other types (Boolean, time, etc).

    Note

    Context filter queries perform case insensitive, exact match searching and NOT token searching. For example, searching for an ID of "james" will return results for "james", "James", and "JAMES".

  • You can use up to two context table filters per visualization.

  • Context table filters can only be joined with AND logic, within the query.

  • Context table filters are limited to a 90 day sliding window.

The following license-based restrictions apply when using context tables in a visualization:

  • The filter query time range must be within the number of months in your license, plus additional months if you are subscribed to any extended retention add-ons.

    Note

    If the filter query is beyond the allowed time range, you will not be able to use a context table and will see a message explaining that the time range is beyond the allowed period.

  • If your license restricts the use of third party logs:

    • and you have an Exabeam Security Analytics license, your query will only return the first 10 events from third party logs.

    • and you have an Exabeam Security Investigation license, you will have seven days of full search, and then will be restricted to the first 10 events from third party logs.

Adding a Context Filter to a Visualization

  1. At the bottom of the Query Filters panel, click the + Context Filter option.

  2. Click the expand arrow (icon-expand.png) to open a condition row.

  3. To define the context filter, enter the following information:

    • Context Field – A field that is assigned as the key attribute in a context table.

    • Operator – Select the appropriate option depending on whether you want to search for data that is or is not present in the context table.

    • Context Table – Select the name of the context collector that you want to include in the visualization filter.

    query-filter-context.png
  4. If you want to add a second context filter, click the + Context Filter option again and enter information to define the second context filter.