Viewing the Content of Event Tracking Tables

Note

Event Tracking Tables can only be used within correlation scenarios. You can add a new event tracking table only while setting up a scenario.

Under Policy > Event Tracking Tables, you see an overview of the existing tables in active correlation scenarios.

Here, you can click on the number in the Counts column to see the content of the respective event tracking table.

Overview of event tracking tables in correlation scenarios.

A content view opens. Note that the maximum number of displayed entries is 64.

Content of an event tracking table that records layer 4 ports per IP address.

If you want to delete the content of the event tracking table, click RESET STATE in this view.

---

Additional References:

• For general information on the concept of event tracking tables, see Event Tracking Tables.

• For step-by-step instructions on how to create an event tracking table, see Creating an Event Tracking Table.

• For further information on the settings options, see Event Tracking Tables.