Overview of procedural filtering

Supported in:

Google SecOps SIEM

Procedural Filtering enables you to further filter information pertaining to an asset, including by event type, log source, network connection status, and Top Level Domain (TLD). The Procedural Filtering menu options change depending on the Google Security Operations view and the breadth and types of security data currently displayed in the UI.

This describes how to access and use Procedural Filtering when investigating an alert using Google Security Operations for the following views:

• User view
• Rule Detections view
• Asset view
• Domain view
• IP Address view
• Hash view
• Raw Log Scan view