Still can't find what you're looking for?Events
The Events page (
Events
The Events tab displays all the events that have been performed on or within your Guardian appliance, from user logins to policy failures, within a reverse chronological list. There are many different types of events you can receive. When viewing the list of events, the event type is listed on the left of each row, followed by a short description of the event, and a time frame indicating when the event was created.
Event Details
To access additional information about a specific event, select the event row to expand the display. Additional fields, specific to that event type, are displayed with key information about the event. For each event type, a different set of fields are displayed. The fields contain the properties (variables) associated with that event type, and each event type is associated with a different set of variables.
For example, for an 'Environment Scanned' event, the properties provide information related to the amount of scans failed, passed, and the total amount of scans performed. Whereas, for a 'Job Updated' event, the properties provide information related to the type of job performed, the status of the job (success/failure), and the email of the user who configured the job to run. The properties are pre-configured according to the event type and cannot be changed.
Tip: From the June 2025 Monthly Release, in V3.56.0 of Guardian onwards, the node_id field was added to the event details section for any node-related events. Using this field, you can reactivate a previously deleted node. For more information, see Reactivate Deleted Node.
Event Actions
For each event type, you can also perform a set of pre-determined actions against it. Click the Ellipsis button (
) to display a drop-down list that contains a list of event actions that have been configured for your Guardian instance. For more information on how to create an event action, see Actions. Event actions are specific to the organization you are in and you can have a different set of actions configured within each organization of your Guardian instance.
To perform an action against an event, click the Ellipsis button () and select an action from the list. Once complete, a confirmation message is displayed and the event action is triggered.
Filter Events
By default, 'All' events are displayed when you access the Events tab. However, it is possible to filter events by 'type' using the search box. Additionally, the query you use can then be saved as a 'view' for repeated use. For more information about views, see Saved Views.
To filter events, you need to start by specifying which event type you want to filter. Enter 'type=' in the search box and then select the event type from the drop-down list.
Once you have specified a type, you can add filters for common attributes and event-specific variables, using the 'AND' function.
Common Attributes
The following list describes the common attributes available to filter:
-
Environment
-
Group (Node Group)
-
Start (Start Date/Time)
-
End (End Date/Time).
For example, to filter all policies run between two days in a default environment, you would write the following query.
type=Policy Ran AND environment=Default AND start=2022-10-14 AND end= 2022-10-15Once ran, the query would return the following results.
Note: If you expect to use this filter frequently, you could save it as a view. For more information, see Saved Views.
Variables
To add filters based on event-specific variables, you need to add 'variables.' before the variable name.
For example, to filter all nodes that were successfully scanned within the Windows node group, you would write the following query.
type=Node Scanned AND group=Windows AND variables.status=successOnce ran, the query would return any results that match the query, including the named event variable.
Note: If you expect to use this filter frequently, you could save it as a view. For more information, see Saved Views.
Saved Views
A saved view is a query that is used to filter events by a specific set of criteria. As described in the Filter Events section, you can filter events by any number of defining criteria. Saved views are useful if you are often filtering events to retrieve information about a specific area of activity. For example, you may want to check how many nodes were successfully scanned within the Windows node group each week. In this scenario, it would be beneficial to save the query as a view, so that you don't have to write the same query each week.
Save a Filter as a View
To save a filter as a view, you need to write the query in the search box and then click to Save View.
The Save View dialog is displayed with the query automatically populated in the Query field. Enter a Name in the field provided that makes the purpose of the query known. Then, select a view type using the radio buttons. A 'personal query' can only be viewed by yourself, the creator. Whereas, an 'organization query' grants all users within your current organisation access to the view. Once complete, click to Save the view.
Note: Depending on what view type you select, the view will be organized into either the Organisation Views or My Views tab of the Saved Views menu, see Saved View Types for more information.
A confirmation message is displayed and the view is created. To access a list of your currently saved views, click the Saved Views button.
Saved View Types
Saved views are organized into three categories: Global Views, Organisation Views, and My Views.
Global Views are accessible for all Guardian accounts registered to your Guardian instance. They cannot be deleted or modified.
Organisation Views are only accessible within the organisation you are currently in. All users within that organisation can access and modify those views.
My Views can only be accessed and modified by the user who created them. The views displayed here are unique to each Guardian user.