Documentation forSecurity Event Manager

Analyze historical data in SEM

The historical data search engine can locate any event data that passes through a particular SEM Manager instance. You can use the historical data search to conduct custom searches, investigate your search results and event data, and then act on your findings.

Learn how to build a search query here.

Use historical search to do the following:

  • Search normalized event data.
  • View, explore, and search significant event activity. Historical search summarizes event activity in a selectable table or list view that you can use to easily select and investigate areas of interest.
  • Use the custom time picker to set a specific date and time range.
  • Conduct custom searches. You can also create complex searches with the intuitive search builder.
  • Save and reuse custom searches.
  • Schedule saved searches.
  • Export your search results to a spreadsheet file in CSV format.

Since certain searches parameters can result in huge number of matching results and thus negatively

impact performance, SEM limits the number of events that are retrieved. For more on this, seeEvent Limits.

To view historical events:

  1. In the SEM HTML5 console, click Historical Events.

  2. Results appear in the Events - Analyze table based on your selected filter. The chart provides a graphical representation of the number of events throughout the query time span.

    Records appear in a table or list view. To change the view, select an option from the More drop-down list.

    If no results appear, place your mouse pointer in the search builder box, and then press Enter.

    The number of events that match this search is displayed.

    Click the information icon for more information.

    To change the maximum limit, seeSet search and filter thresholds.

  3. Refine your search results with the custom time picker.

    You can select a quick pick, or set a specific date and time range.

  4. Refine you search even further by dragging your mouse pointer over a section of the histogram.

  5. Select a single event in the table to find additional information in the Event Details pane. Use the search box to identify and highlight specific data.

    Learn how to create search queries here, and export your results here.