> ## Documentation Index
> Fetch the complete documentation index at: https://docs.levelblue.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Events List View

USM Anywhere provides a centralized view of your events. Go to **Activity > Events** to see this centralized view.

The Events page displays information on events. These are the different parts of the Events page:

* On the left side of the page are the search and filters options. Use filters to delimit your search. See [Searching Events](searching-events) for more information.
* At the top of the page, you can see any filters you have applied, and you have the option to create and select different views of the events.
* The main part of the page is the list of events, where each row describes an individual event. Click an event to open a summary view. See [Viewing Event Details](viewing-events-details) for more information.

Your environment can display events when an asset has not received messages within a configured period of time. To see this kind of events, you previously need to configure a period of time that indicates when the asset has to start generating events. See [Events Created When an Asset Stops Sending Data](../asset-management/asset-administration/event-timeout-threshold) for more information.

If you want to analyze the data and see the additional columns without having to scroll left and right, you can maximize the screen and hide the filter pane. Click the <img src="https://mintlify.s3.us-west-1.amazonaws.com/levelblue-5324744e/images/central-any-app/buttons/to-close-filter-sidebar.svg" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} /> icon to hide the filter pane. Click the <img src="https://mintcdn.com/levelblue-5324744e/L0uo3frxKf03lkfc/images/central-any-app/buttons/to-open-filter-sidebar.svg?fit=max&auto=format&n=L0uo3frxKf03lkfc&q=85&s=a2b105a32651fb994bfbbba0d85db9e1" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/to-open-filter-sidebar.svg" /> icon to expand the filter pane.

The following table lists the fields you see on the page.

**List of the Default Columns in Events**

<table>
  <thead>
    <tr>
      <th>Column / Field Name</th>
      <th>Description</th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>Event Name</td>
      <td>Name of the event.</td>
    </tr>

    <tr>
      <td>Time Created</td>
      <td>The date and time of the creation of the event. The displayed date depends on your computer's time zone.</td>
    </tr>

    <tr>
      <td>OTX</td>
      <td>Indicate if it is an <Tooltip tip="The world’s first truly open threat intelligence community. Enables collaborative defense with open access, collaborative research, and seamless integration with USM Anywhere and USM Appliance, and AlienApps for other security products.">OTX</Tooltip> event or not. If the icon displays active, click it to go to <a href="https://otx.alienvault.com/">OTX</a>.</td>
    </tr>

    <tr>
      <td>Source <Tooltip tip="An IP-addressable host, including but not limited to network devices, virtual servers, and physical servers.">Asset</Tooltip></td>

      <td>
        <p><Tooltip tip="A hostname is a label that is assigned to a device connected to a computer network and is used to identify the device on the network.">Hostname</Tooltip> or IP address of the <Tooltip tip="Reference to a computer on a network.">host</Tooltip> (with the national flag if the country is known) that initiates the event.</p>
        <p><Warning>**Important:** If you want to create a rule, use the Source Name or Source Asset ID field instead of using this field.</Warning></p>
      </td>
    </tr>

    <tr>
      <td>Destination Asset</td>

      <td>
        <p>Hostname or IP address of the host (with the national flag if the country is known) that receives the event.</p>
        <p><Warning>**Important:** If you want to create a rule, instead of using this field, use the Destination Name or Destination Asset ID fields.</Warning></p>
      </td>
    </tr>

    <tr>
      <td>Sensor</td>

      <td>
        <p>Name of the USM Anywhere <Tooltip tip="Sensors are deployed into an on-premises, cloud, or multi-cloud environment to collect logs and other security-related data. This data is normalized and then securely forwarded to USM Anywhere for analysis and correlation.">Sensor</Tooltip> detecting the event. The type of sensor is also displayed below the sensor name.</p>
      </td>
    </tr>

    <tr>
      <td>Username</td>
      <td>Username associated with the event.</td>
    </tr>
  </tbody>
</table>

The asset name includes the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/angle-down.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=48353c06623bc41301800dc185292758" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/angle-down.svg" /> icon if the asset is not in the system, or the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/chevron-down.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=417e8bbfd7386ba83a4b629d5a935a80" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/chevron-down.svg" /> icon if the asset has been added to the system.

Click the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/angle-down.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=48353c06623bc41301800dc185292758" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/angle-down.svg" /> icon to access the following options. Your access to these options may vary based on your user role. See [Role-Based Access Control (RBAC) in USM Anywhere](../user-management/rbac) for more information:

* **Add to current filter**: Use this option to add the asset name as a search filter. See [Searching Events](searching-events).
* **Look up in OTX**: This option searches the IP address of the source asset in the Open Threat Exchange page. See [Using OTX in USM Anywhere](../otx/using-otx-in-anywhere)
* **Add asset to system**: Use this option to create the asset in the system. See [Adding Assets](../asset-management/asset-administration/adding-assets).

Click the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/chevron-down.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=417e8bbfd7386ba83a4b629d5a935a80" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/chevron-down.svg" /> icon to access the following options. Your access to these options may vary based on your user role. See [Role-Based Access Control (RBAC) in USM Anywhere](../user-management/rbac) for more information:

* **Add to Current Filter**: Use this option to add the asset name as a search filter. See [Searching Events](searching-events) for more information.
* **Look up in OTX**: This option searches the IP address of the asset in the OTX page. See [Using OTX in USM Anywhere](../otx/using-otx-in-anywhere) for more information.
* **Full Details**: See [Viewing Assets Details](../asset-management/asset-administration/viewing-asset-details) for more information.
* **Configure Asset**: See [Editing Assets](../asset-management/asset-administration/editing-assets) for more information.
* **Delete Asset**: See [Deleting the Assets](../asset-management/asset-administration/deleting-assets) for more information.
* **Assign Credentials**: See [Managing Credentials in USM Anywhere](../vulnerability-assessment/credentials) for more information.
* <Tooltip tip="Authenticated scans are performed from inside the machine using a user account with appropriate privileges.">**Authenticated Scan**</Tooltip>: This option displays depending on the USM Anywhere Sensor associated with the asset. See [Running Authenticated Asset Scans](../asset-management/asset-administration/running-vuln-scan) for more information.
* **Scan with BlueApp**: This option enables you to run an asset scan through an BlueApp. See [Running Asset Scans Using a BlueApp](../asset-management/asset-administration/scan-with-alienapp) for more information.
* **Run Scan**: This option displays depending on the USM Anywhere Sensor associated with the asset. See [Running Asset Scans](../asset-management/asset-administration/running-asset-scan) for more information.
* <Tooltip tip="An identified configuration of deployed software or features of software that is in use, which is known to be insecure.">**Configuration Issues**</Tooltip>: This option opens the Assets Details page. The Configuration Issues tab is selected in the page. See [Viewing Assets Details](../asset-management/asset-administration/viewing-asset-details) for more information.
* **Vulnerabilities**: This option opens the Assets Details page. The Vulnerabilities tab is selected in the page. See [Viewing Assets Details](../asset-management/asset-administration/viewing-asset-details) for more information.
* **Alarms**: This option opens the Assets Details page. The Alarms tab is selected in the page. See [Viewing Assets Details](../asset-management/asset-administration/viewing-asset-details) for more information.
* <Tooltip tip="Any traffic or data exchange detected by LevelBlue products through a sensor or external devices such as a firewall.">**Events**</Tooltip>: This option opens the Assets Details page. The Events tab is selected in the page. See [Viewing Assets Details](../asset-management/asset-administration/viewing-asset-details) for more information.

You can configure the view you want for the list of events. See [Event Views](views) for more information.

Click **Generate Report** to open the Configure Report dialog box. See [Create an Events Report](exporting-events) for more details.

The graph above the events list displays the amount of events in a period of time. You can change this period by clicking **Last 24 Hours** filter.

Click the <img src="https://mintcdn.com/levelblue-5324744e/jZ2ECZwEPoyrYIbL/images/central-any-app/buttons/line-chart.svg?fit=max&auto=format&n=jZ2ECZwEPoyrYIbL&q=85&s=f88721862469326d69c6971d05c853ad" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="24" height="24" data-path="images/central-any-app/buttons/line-chart.svg" /> icon to access these options:

* **Actions / User**: Reports USM Anywhere account activity based on specific account users and summarized by Create, Read, Update, and Delete categories.

* **Count / Time**: The Count/Time view provides a graphical representation of the number of events in a period of time.

  <Warning>
    Important: The period of time is mapped with the `timestamp_received` field. This field can be overwritten by the current sensor UTC timestamp if, when processing events, a delay is detected up to 15 minutes or the `timestamp_received` field is not provided.
  </Warning>

* **Auth / User**: Reports authorization actions.

* **Source Map**: Provides the number of events associated with each country on a global map.

Click the <img src="https://mintcdn.com/levelblue-5324744e/jTImDFBjBH7kNNGB/images/central-any-app/buttons/star.svg?fit=max&auto=format&n=jTImDFBjBH7kNNGB&q=85&s=0ba9b13f9c26202f050ba6ac9881fd3a" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/star.svg" /> icon to bookmark an item for quick access.

<Note>
  **Note:** You can view your bookmarked items by going to the secondary menu and clicking the <img src="https://mintcdn.com/levelblue-5324744e/jTImDFBjBH7kNNGB/images/central-any-app/buttons/star.svg?fit=max&auto=format&n=jTImDFBjBH7kNNGB&q=85&s=0ba9b13f9c26202f050ba6ac9881fd3a" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/star.svg" /> icon. This will display all of your bookmarked items and provide direct links to each of them.
</Note>

Click the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/filter.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=6baa3db537fa67cf45abde78673651d6" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/filter.svg" /> icon to filter your search by row fields. See [Filtering Events by Row Fields](searching-events) for more information.

You can choose the number of items to display by selecting **20**, **50**, or **100** below the table. You can classify some columns by clicking the icons to the right side of the heading. You can sort the item information in ascending or descending order.

## Configuring Columns

Within the page, you can configure the columns and fields that display in the list view. You can also save your configuration settings for later use.

**To configure your columns**

1. From the events list view, click the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/manage-columns-final.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=1b58a57a870d7fee8cb991427b7fe41f" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/manage-columns-final.svg" /> icon.

   The Manage Columns dialog box opens.

   <Frame>
     <img src="https://mintlify.s3.us-west-1.amazonaws.com/levelblue-5324744e/images/usm-anywhere/user-guide/events/managecolumns.webp" />
   </Frame>

2. Search the columns you want to have in the list view by using the search field.

3. Use the <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/arrow-right.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=8c2b99123bbdd3095a2c38366c2067f1" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/arrow-right.svg" /> and <img src="https://mintcdn.com/levelblue-5324744e/T1hrc0hK0aza_DCc/images/central-any-app/buttons/arrow-left.svg?fit=max&auto=format&n=T1hrc0hK0aza_DCc&q=85&s=3eb55b4695ad299ad5185f0d56183be1" style={{ height: "1em", verticalAlign: "middle", display: "inline-block", margin: "0 0.25em" }} width="20" height="20" data-path="images/central-any-app/buttons/arrow-left.svg" /> icons to select or deselect from the available columns.

4. You can order the columns by clicking and dragging the column to the desired place.

5. Click **Apply**.

<Note>
  **Note:** If you generate a report when you have set custom columns, your report keeps the columns you have configured.
</Note>

<Warning>
  **Important:** If you want to keep your configuration, you need to save it by selecting **Save View > Save As**. Otherwise, your custom view is not kept when you move to another feature. See [Event Views](views) for more information.
</Warning>
