In HTML view, when a user filters any event using signature ID, the filter window should populate the signature ID. But, it shows Rule Message Name instead, as shown below:
- Go to the Default Event summary.
- Select any rule message name and right-click on it.
- Click filter on and select signature ID.
- The Filter Window displays the Rules Message name, which gives the false impression that you can filter using Rule Name:
Signature ID = User Device failed logon
In Flash view, filtering works as expected. The filtering signature ID populates ID instead of Rule Name as follows:
- Go to the Default summary dashboard.
- Select any rule message name.
- Click signature ID in filter pane. The Signature ID is populated in the filter. For example,
306–50079 displays in the filter.
