Viewing Active Channels

Viewing and using active channels include creating them, filtering them, customizing contents, changing presentation formats or layouts, and deleting them.

When viewing an active channel, keep the following in mind:

• If a channel is open when Daylight Savings Time goes into or out of effect, the live channel will not reflect the correct start and end times until the channel is closed and re-opened.

• If an active channel uses a filter that applies conditions to a list data type field, the active channel will include multiple rows for the same event or resource (for example, actors) channels. This behavior is expected.

Purpose:

• View events

• View resources such as assets, vulnerabilities, cases, and so on

Where: Navigator > Resources > Active Channels

To view an active channel:

1. Right-click a channel.

2. Select Show Active Channel.

The selected channel is displayed in the Viewer.

To edit the time window for an active channel:

1. Click the edit time window button that looks like a pencil (next to the active channel Start Time).
2. Modify the Start Time and End Time.
3. Click OK.

To view resources in active channels:

Right-click a resource or group, and choose Show <ResourceName>. The resources are displayed in an active channel view.

To view results of triggered rules:

See Verifying Rules with Events.