View Arctic Wolf Agent filters

On the Agent page, you can add or remove filters to refine the risks that appear in the Agent table.

These filters are available:

  • Hostname — The host name.
  • Status — The Agent status: Online, Offline (# hours), Offline (# days), Offline (> # days), Contained, or Degraded.
  • OS Version — The OS of the host.
  • Containment Driver — One of these status values:
    • Disabled — The containment driver is waiting to be uninstalled.
    • Pending — The containment driver is waiting to be installed.
    • Version — The version number of the installed containment driver.
    • N/A — The containment driver can't be installed on the endpoint.
  • Sysmon — One of these status values:
    • Disabled — Sysmon management is not enabled for this endpoint.
    • Pending — Sysmon management is enabled by the endpoint, but Sysmon is not installed on the device.
    • Version — Sysmon management is enabled, and the installed version of Sysmon displays.
    • N/A — Sysmon is not supported on Linux or macOS.
  • IP Address — The IP address.
  • Version — The version of the Agent.
  • Group Assignment — The group that manages the endpoint.
  • Domain — The Active Directory domain name used to manage users.
  • OS Type — Either Linux, macOS, or Windows.
  • Architecture — Either x64, x86, or arm64 architecture.
  • First Reported — The date and time that the Agent first reported.
  • City — The geographical location of the host.
  • Country — The geographical location of the host.
  • Last Reported — The date and time that the Agent last reported.
  • Username — The username of the Agent.
  • ID — The UUID of the Agent.
  • VDI State — The image used to create the non-persistent Virtual Desktop Infrastructure (VDI) instance. This column does not display details for persistent instances. State options include:
    • None — This instance is not part of a VDI configuration.
    • Instance — This instance was created from the golden image.
    • Template — The master image template.

Add a filter

You can add filters to refine the data that displays in the table.

When a filter is active, a number overlaps the filter icon to indicate the number of active filters. For example, indicates two active filters.
  1. Click Filters.
  2. In the first filter row, do these actions:
    • Columns — Select a column on which to apply the filter.
      Note: In some cases, if you select a column that is not currently in the table, the column is added to the table.
    • Operator — Select an operator that describes how the filter value relates to column. The options are different based on the column. Some examples include:

      • is any of — Returns results that match one or more of the specified values.

      • is — Returns results that match all of the specified value.

      • is between — Returns results that are on or between the specified date range.

    • Value — Enter or select a value that is needed in the table column.
  3. Optional: Repeat this step as needed to add additional filters:
    1. Click + Add filter.
    2. In the next filter row, select a Column, Operator, and Value.

Remove all filters

You can remove all filters to view all available data in the table.

  1. Click Filters.
  2. Click Remove all.
    A single filter row appears with the default Columns and Operator options selected.