Custom Report Query

[docdriza]

Out of the event quries, I am looking for something more than what is offered in ESM 9.3.1. In the Object Event QueryI am trying to edit the fields. I made a copy of the original and clicked edit, but I still cannot edit the fields. What am i doing wrong?

[lichnt]

Can you capture ?

[docdriza]

Can I capture what?

[docdriza · Accepted solution]

No longer an issue

[shuklagaurav83]

Can you please share what is its solution. I am also facing the same issue. Unable to edit the fields so that i can add my new value field instead.

[Rising_Star]

Hi,

New to McAfee

Reading the thread I couldn't fully understand what it takes from administrator to customize query or report. I am interested in extracting "URL" values into a table view in a new report Im creating.

for some reason, in "Query Wizard" >> "Event Queries" I can seem to find "URL". this is a custom type field. what I need to do in order for this field (or any other) will be visible under "Event Queries"?

another question, is how can I create a table to include more that one field?

for example I want to present "Dest IP" and then "Dest Geo country". how can I present more than 1 column (other than event count etc.)

thanks