Skip to main content

Facet

Overview​

The facet sidebar is located on the left side of the Events Search page (Data Lake → Search) and of the SIEM search pages (Behavior Summary, Behavior Timeline, and Behavior Rules).

The facet acts as a filter allowing information to be focused on or removed from results on the page. Information in the facet is presented first by the field attribute. Results for the field attribute are presented underneath in order of the number of times that value appears in the result set, the count.

In this section these three components are referenced:

  • attribute: how data is grouped: e.g. "Tags"
  • value: the values in the attribute field: e.g. "WARNING", "INFO", "sshd", "hb", "systemd"
  • count: the number of times that value appears in the set: e.g. "79776", "32494", "21715", "5784", "5223"

Three State Selection​

Next to each value that appears in the attribute group there is a checkbox. This checkbox has three states:

  • open: neutral state, this does not impact the search result.
  • checked: focus, results that appear must include one of the checked values in the attributes.
  • minus (excluded): results that appear must not include this value regardless of any other checked values.

Increasing and Decreasing Results​

Each facet group's header carries three small round icon buttons: a plus, a minus, and a down arrow. The plus and minus buttons increase or decrease the number of listed values.

Relationship Between Attributes​

Checked boxes between attribute types act like logical and statements, while checked boxes in the same attribute act as logical or statements.

Excluded values are removed from all results regardless of checked boxes elsewhere.

The Facet Toolbar​

A small toolbar of icon buttons sits at the bottom of the facet sidebar. On the SIEM pages it holds three buttons — a red X, a pencil, and a magnifier. On the Data Lake → Search page a save (floppy disk) button is also present.

Search (magnifier)​

Clicking the magnifier button re-runs the search using the checked/excluded attributes in the facet.

Facet toolbar with the Search tooltip shown over the magnifier button

Reset Facet (red X)​

Pressing the red X button clears the current facet selections.

Editing the Facet Fields (pencil)​

Clicking the pencil button opens the Search Facets dialog, which controls the facets shown in the sidebar. The dialog is a table with Title, Field, and Size columns plus an Actions column:

  • Title — the group label shown in the sidebar.
  • Field — the event field the group aggregates, in dot notation.
  • Size — the number of values the group returns.

Each row has a drag handle on the left for reordering and a red trash button under Actions to remove the facet. Click + Add Field to append a new facet row, then Save to apply the changes or Cancel to discard them.

Search Facets dialog listing each facet's title, field, and size with delete buttons, an Add Field row, and Save and Cancel buttons

Facet Configurations​

For each page there is a default facet configuration. On the Data Lake → Search page, users can also create their own facet configurations and save them for later use.

Saving a Configuration​

On the Data Lake → Search page, click the save (floppy disk) button in the facet toolbar to open the Save Facet dialog. Provide a short name and description, then click Save.

Save Facet dialog with Name and Description fields and Save and Cancel buttons

Switching Configurations​

The Facet: selector at the top of the facet panel on the Search page shows which configuration is applied. Click it to switch among the saved configurations — the general Default plus a per-source default for each integrated data source (Default-AWS_CloudTrail, Default-O365_Exchange, Default-Okta_Login, and so on).

Selecting Default applies it directly. Selecting any other configuration switches the panel to that configuration's facet groups and opens a Modifying Query confirmation offering to rewrite the search query to match that source — for Default-AWS_CloudTrail it asks whether to modify the query to @source:cloudtrail. Click Yes to replace the query with the suggested filter, or No to keep the current query.

Modifying Query confirmation asking to change the query to the cloudtrail source filter, shown over the Default-AWS_CloudTrail facet groups

The Facet Library​

The round blue pencil button beside the Facet Search Configurations heading on the Search page opens the library of saved facet definitions — a Search Facets dialog with Group, Name, Description, Indexes, and Actions columns, per-row edit, settings, download, and delete buttons, and an Import button for bringing in a facet definition.

Search Facets dialog listing saved facet definitions with per-row action buttons and Import and Close buttons

note

In the older interface, saved facets were viewed on the Data Table → Search Facets page. That page does not exist in the current interface — saved facet configurations are managed through the dialogs described above.

Exporting Results​

To export the current result set, use the Export Data button in the page header of the Events Search page (not the facet toolbar). If the search returned no results, nothing is exported and a red Export error toast appears reading No events data to download; dismiss it with its x.