Out of the event quries, I am looking for something more than what is offered in ESM 9.3.1. In the Object Event QueryI am trying to edit the fields. I made a copy of the original and clicked edit, but I still cannot edit the fields. What am i doing wrong?
Solved! Go to Solution.
New to McAfee
Reading the thread I couldn't fully understand what it takes from administrator to customize query or report. I am interested in extracting "URL" values into a table view in a new report Im creating.
for some reason, in "Query Wizard" >> "Event Queries" I can seem to find "URL". this is a custom type field. what I need to do in order for this field (or any other) will be visible under "Event Queries"?
another question, is how can I create a table to include more that one field?
for example I want to present "Dest IP" and then "Dest Geo country". how can I present more than 1 column (other than event count etc.)