Events

In this article we explain Events; a vital tool in collecting useful raw data.

Overview

Skylight Interceptor Events provides access to “raw” events, which is a crucial piece of functionality for threat hunting and forensics. Using Events, you can query raw data that has been collected and then put that data towards a better understanding of what has happened on certain IP addresses in a particular protocol.

Accessing Events

► To access events:

1. Go to Cybersecurity ▶ Events.

Once you are in the Events tab, you can view information in various layers. By selecting the area of interest from the left toolbar, you can choose from the following:

• ICMP
• TCP
• UDP
• TLS
• DCERP
• DNS
• HTTP
• Databases
• CIFS
• SSH

Distribution Settings

The distribution settings allow you to show or hide specific parameters, as shown below:

The distribution setting columns are easily rearranged by grabbing and dragging them into the order you prefer, as shown below:

Filtering Events

► To filter events:

1. Go to Cybersecurity► Events

2. Use common filter bar, as shown below
   

   Or click on the value you are interested in from within the distribution view, as shown below.

You can add one or more values to the filter from the event table. These values can be added as included or excluded, simply by choosing the appropriate icon.
See the example below.