Viewing and Taking Action on the Cached Events Page

When the initial processing of a cached event view has completed, its name displays on a menu on the Cached Events page.

To view this page, in the console menu, click Reports > Cached Events.

Choosing one of the views displays the latest results for that view. A legend at the top of the view indicates the time period covered by these results.

You can use the Show Filters and Show Columns panel to further customize the data that is displayed in a cached view. There are several differences in behavior for these features between a Cached Events page view and a view on the main Events page:

• You can use Show Filters to further filter the cached view. If you add a filter, keep in mind that you are filtering only on the data that is included in the cached view.
• You can use the Show Columns panel to add or remove columns in a cached view. The column changes persist while you remain on the page. I you navigate off of the page and then reload the cached view, it returns to the column layout it had when it the cache request was first made.
• You cannot modify the filters that were used to create the cached view – they are grayed out and inoperative.
• You can use the Timestamp filter to further restrict the data shown in the cached view, but you cannot extend it. There is no Max Age option on the Cached Views page.

The Cached Events page includes an Action menu similar to the one on the Events page. You can take actions such as approving or banning files shown in events listed in the cached view. There are some differences between the Events page and the Cached Events page.

If you take actions while on the Cached Events page, the events shown in the cached view reflect conditions at the time the cache request was made. Event information such as file state, rules being enabled or disabled, or computer properties, does not change due to an action you take on the Cached Events page.

For example, if an event on the Cached Events page shows that a file was blocked because it was unapproved, you can approve that file, but in the Cached Events view the event still shows it as unapproved because that was its state when the event occurred. However, if a file name or hash shows as a link in the Cached Events view, you can see the new file state in the Object Preview if you hover over the file hash. Its new state displays on the Files and File Details pages. In addition, actions you take on the Cached Events page that affect file state display on the Events page as new events.