Customize the Events View
Any changes made to the Event Logging page are automatically saved for when you navigate away from this page and come back at a later time.
Note | The Live and Historical events view have the same configuration. When you customize the events view, these changes are applied to both the Live and Historical view. |
Show or Hide Columns
You can modify the event view for both live and historical events to only include column headers that apply to the view you want. Click the column filter icon 
located to the right of the columns, select or deselect the columns you want, and then click Apply.
Columns with asterisks are provided within the event table by default, although you can remove them at any time.
Search and Add Columns
You can search for more columns, which are not part of the default list, and add them to the event view for both live and historical events. Note that adding many columns for customizing the table may reduce performance. Consider using fewer columns for faster data retrieval.
Alternatively, click the + icon next to an event to expand it and view the hidden columns. Note that some of the event fields displayed when you expand an event can have a different name compared to the corresponding column name. To correlate the events fields displayed when you expand an event to the corresponding column name, see Correlate Threat Defense Event Fields and Column Names.
Reorder the Columns
You can reorder the columns of the event table. Click the column filter icon located to the right of the columns to view the list of selected columns. Then, drag and drop the columns into the order you want. The column at the top of the list in the drop-down menu appears as the left-most column in the event table.