Documentation forSecurity Event Manager

Analyze historical data in SEM

The SEM historical data search engine can locate any event data that has passed through a particular SEM Manager instance. You can use the historical data search to conduct custom searches, investigate your search results and event data, and then act on your findings.

Learn how to build a search query here.

Use historical search to do the following:

  • Search normalized event data.
  • View, explore, and search significant event activity. Historical search summarizes event activity in a selectable table or list view that you can use to easily select and investigate areas of interest.
  • See specific date and time range data using the custom time picker.
  • Conduct custom searches. You can also create complex searches with the intuitive search builder.
  • Save and reuse custom searches.
  • Schedule saved searches.
  • Export your search results to a spreadsheet file in CSV format.

Since certain searches parameters can result in huge number of matching results and thus negatively impact performance, SEM limits the number of events that are retrieved. For more on this, see Event Limits.

To view historical events:

  1. From the SEM console, click Historical Events.

    When you first open Historical Events it shows unfiltered events (that is, all events on the network) for the last ten minutes as a chart and a table.

    1Query BuilderThis is where you build queries to filter the historical results. For information on creating queries, see Create a search query.
    2Time PickerThis enables you to specify the time period for which you want to apply the query in the query builder.
    3Query menu.For information on creating For further information, see Search Queries.
    4Available query fields.Expand these categories to view the fields available for filtering historical events. Drag these to the Query Builder field, or click the Add icon. For information on using these fields and creating queries, see Create a search query.
    5Event chartThe number of events over the specified period of time are displayed as a simple bar chart. Drag the cursor over a time period to zoom in on that period; click on the icon when then appears in the top right of the chart to return to the previously specified period.
    6Event DetailSelect a single event in the table to display additional information in the Event Details pane.
    • Click Export to save as a CSV file.
    • Click Switch to List view to display the filtered events as a list.
    • Click Switch to Table view to display the filtered events as a table.
    • Click Hide Chart to remove the chart from display.
    • Click Show Chart to display the chart.
    8EventsShows the total number of events meeting the query.
    9Table or ListBy default the table view of the selected historical data is displayed. Click on any item in a row to display the Event Detail column for the event.

Maximum number of events shown

The number of loaded events is displayed here.

By clicking the icon you can see:

  • the number of loaded events
  • the maximum number of loaded events
  • the number of event found (loaded and not-loaded)

Since searches with a high maximum threshold can negatively impact performance, you can set the maximum number of events that are loaded. On average, every 1000 returned search results consumes approximately 100MB of RAM. This can result in up to 10GB being consumed by one search query if the threshold is set to the 100,000 maximum.

  1. Click the information icon for more information.

  2. To change the maximum limit, click Change limits and see Set search and filter thresholds.

The custom time picker

  1. Refine your search results with the custom time picker.

    You can select a quick pick, or set a specific date and time range.