Events

Events helps you detect activity, review the records NeQter creates, and choose how those records reach your team. A monitor evaluates a saved search on a schedule. When its condition matches, it can create an event. An alert configuration delivers matching events by email or webhook.

For a complete walkthrough, follow the Create a Monitor Guide or the Alert and Template Guide.

The Monitoring landing page. The top tabs and the expanded Events navigation open the same four pages.

On this pageExpand sectionsCollapse sections

• Events
  • Open Events and choose a page
  • Monitoring
    • Set the time range and refresh
    • Read the summary and charts
    • Choose Cards or Table
    • Find a monitor
    • Interpret monitor status
    • Open a monitor’s configuration
    • Review monitor events
    • Read status and recent results
    • Investigate an aggregation value
    • Use View, Edit, and Delete
    • Investigate monitor errors
    • Create a monitor
    • Choose the saved search
    • Choose a monitor type and threshold
    • Set the schedule in Advanced
    • Limit repeated events with Cooldown
    • Delay an event with Pause and collect
    • Save or discard a monitor draft
    • Start from a template
    • Open Monitoring help
  • Events
    • Read the overview and choose a time range
    • Use the event table
    • Build a precise filter
    • Choose the fields you want to see
    • Investigate an individual event
    • Dismiss reviewed events
    • Export event records
  • Alerts
    • Create an alert rule
    • Match specific event codes
    • Match a minimum severity
    • Deliver by email
    • Deliver to a webhook
    • Maintain and troubleshoot delivery rules
  • System events
    • Change the severity of future system events
    • Find the relevant event family

Open Events and choose a page

Expand Events in the main navigation, or use the tabs across the top after opening it.

Reports has its own navigation and separate documentation. For network interfaces, service checks, and host availability, use Hosts > Monitor.

Global administrator access is required to view or change Monitoring and Alerts configurations. The Events page provides dismissal controls to users with Events write access. The controls available to your account may therefore differ from these administrator screenshots.

For a first review:

1. Open Monitoring and confirm the time range.
2. Review Monitor errors and the monitors marked Needs attention.
3. Open a monitor’s Details or View action to inspect its configuration, recent runs, and events.
4. Open an event with its eye button and read its reason and supporting information.
5. Use Alerts when you need matching events delivered to a destination.

Monitoring

Monitoring runs a saved Discover search repeatedly and compares the result with a configured threshold. The page shows both what is configured and what happened during the selected history window.

Set the time range and refresh

The header starts at Last 7 days. Use the calendar/dropdown control for Quick select: choose the direction, amount, and unit, then select Apply. Commonly used provides ranges such as Today and Yesterday; Recently used date ranges provides convenient history selections. The left/right arrows move to the previous or next time window.

Quick select changes the history displayed on the page. Refresh every controls how often this view updates.

Show dates exposes the start and end values so you can inspect or change them. Use relative values for a moving window or an absolute start and end when investigating a specific period. Apply the date change when the picker asks you to update it, then use Refresh to reload the page.

Under Refresh every, enter a positive interval, choose its unit, and select Start when watching new activity. Stop automatic refresh when you want the page to stay on the current results. Page refresh affects what you are viewing. A monitor’s own Frequency, Time window, and daily Time range determine when it evaluates data.

For example, a monitor can run every five minutes, evaluate the preceding ten minutes, and appear in a page displaying the last seven days. Changing the page to one hour does not change that monitor’s five-minute schedule or ten-minute lookback.

Read the summary and charts

Activity over time compares events created, cooldown skips, and errors. Use the legend to identify each colored series and hover over the chart to inspect values. Events by severity groups normal monitor events by severity. An empty chart can mean there was no matching activity in the selected history window.

If the page says Activity unavailable, it could not load event history. The monitor configurations can still be available. Use Try again or Refresh to retry; a dash is different from a successful count of zero.

The summary and upper charts cover all configured monitors. The search and severity filter in the Monitors section narrow the list below them.

Choose Cards or Table

Use Cards for a visual comparison of individual monitors. Each card shows its status, severity, name, description, type, event code, result chart, run frequency, most recent event, and created/skipped/error counts. Details opens the monitor. The pencil opens its edit form; the trash button begins deletion.

Cards place each monitor’s recorded results beside its activity counts. The result chart and the created-event count measure different things.

Use Table to compare many monitors in rows. NeQter remembers your Cards/Table choice in this browser.

Use the page numbers, next/previous arrows, and Rows per page below the table to move through records. Sortable column headings provide an additional way to arrange rows.

Find a monitor

Type into Search by name, code, type, or severity to narrow the monitor list. The search also includes descriptions, ignores letter case, and matches part of a value. A code such as 9001 identifies events generated by that monitor.

Open All severities to choose Critical, High, Medium, Low, or None. Selecting All severities removes that restriction. The Showing x of y count reports the filtered list size and total configured monitors.

The severity filter narrows the monitor list. It does not change any monitor’s configured severity.

Use Sort to choose the order most useful for your review.

Choose Most errors when investigating failed evaluations, or Recent activity when looking for the latest created events.

If no records match, Clear filters clears the search and severity restriction. A monitor does not disappear from the configuration list simply because it had no events during the selected time range.

Interpret monitor status

A Quiet monitor may have run successfully without meeting its condition. Review its recent runs before treating silence as a failure.

Open a monitor’s configuration

Select Details on a card or View in the table’s Actions menu. The details panel opens over the Monitoring page. Its time picker starts with its own Last 7 days range; check it when your investigation uses a different period.

This monitor evaluates a saved Duo Security search. Its configured lookback, frequency, threshold, grouping field, and cooldown are visible together.

The header identifies the monitor and shows severity, frequency, type, and enabled cooldown. The three summary cards show this monitor’s created events, skipped matches, and errors within the details time range.

Expand or collapse Configuration with its arrow. Read the name, severity, Time frame (the lookback), daily schedule, active days, description, monitor type, saved-search ID, threshold, aggregation field, frequency, cooldown, and pause-and-collect settings. These are display values; use Edit to open a form for changes.

Use the panel’s own scrollbar to reach later sections. Close at the bottom or X in the upper-right returns to the monitor list.

Review monitor events

Expand Monitor events to see the event history. The Events over time chart shows when events were created; the table provides timestamp, code, type, category, action, and reason.

The eye in a row opens that event’s details. The displayed event code connects the record to this monitor.

Use the table’s search field to narrow its rows. Columns hidden opens the column chooser; column menus provide visibility and positioning controls. The row eye opens the event viewer, where you can read the event’s details and supporting information. Event-viewer controls are explained in the Events section.

Show skipped includes cooldown skip history alongside the normal event chart and broadens the table to related records tagged with this monitor’s code. Related error records may also appear in the table. Select Hide skipped to return to normal monitor events.

The detail tables initially load up to 500 rows. When more are available, Load 500 more increases the loaded set, up to 10,000. The table’s page size controls how many loaded rows you see at once.

Read status and recent results

Expand Status and results to compare the monitor’s threshold with its recorded evaluations. For an aggregated Maximum monitor, the page includes a pie chart of aggregation values and a result chart broken down by those values. Other types show their applicable measurement chart.

A run can show Matched while its Event outcome says Event creation skipped. Matching the condition and creating a new event are separate steps.

The Monitor status area repeats the threshold, type, aggregation field, and saved search. Active identifies the monitor configuration here; use recent run outcomes and errors to assess what happened. Select the saved-search link to open it in Discover in another tab.

Recent runs shows the last 20 matching runs in the selected range. If fewer than 20 matches exist, NeQter fills the list with the closest nonmatching runs. It is a focused review list, rather than a complete chronological record of every execution.

Use Rows per page to show 5, 10, or 20 recent results and the page arrows to move between them.

Investigate an aggregation value

For a Maximum monitor with an aggregation field, Top aggregation values lists the individual values and their strongest recorded results.

Here the aggregation field is user.name, so each row represents a user value observed by the monitor.

• Aggregation value identifies the group, such as a user name or source address.
• Max hits is that group’s highest recorded hit count within the selected range.
• Monitor query start time / end time show the evaluation window associated with that maximum result.
• Detected count counts matching result records for the group during the selected range.
• Discover > Open opens the saved search in another tab, with that aggregation value and the details time range.
• The eye in Actions opens the underlying monitor-result document for inspection.

Use the sortable count headings and pagination to compare values. A large hit count identifies activity to investigate; the monitor’s query and threshold explain why it mattered.

Use View, Edit, and Delete

In Table view, select the three-dot Actions button when the actions are collapsed.

The menu belongs to its row. Confirm the monitor name before opening an edit or deletion workflow.

Use Cancel in an edit form or deletion confirmation to leave the saved monitor as it was. A deleted monitor cannot be restored with an Undo button.

Investigate monitor errors

Open the affected monitor and expand Monitor errors. This section starts collapsed. Its chart shows errors over time; the rows include timestamp, event code, action, and reason.

The error list explains the Needs attention status. Open a row’s eye button to read its full reason.

Use the search field to find a particular code or reason. Widen the time range if you are tracing when the problem started. An aggregation limit, search failure, or processing error needs a different correction; read the event before editing the configuration. After saving a correction, review subsequent runs and refresh the history. Earlier errors remain visible when they are inside the selected range.

Create a monitor

Start by opening Discover and saving a search that selects the records you want evaluated. Confirm the selected data view, query, and filters produce useful results. Then return to Events > Monitoring and select Create monitor.

The blank form starts with Low severity, a ten-minute lookback, and Maximum matching with threshold 1. A saved search is required.

The time-window controls allow 5–10,080 minutes, 1–168 hours, or 1–7 days. The threshold input allows 1–1,000. Choose the lookback and frequency together so you understand whether adjacent evaluations overlap.

Choose the saved search

Open Saved search, type part of its name to find it, and select the result. No saved search is a placeholder and cannot be used to save a monitor. The clear button removes the draft selection.

Select a search appropriate to the data and condition you want to monitor. Choosing it does not modify the saved search.

The selected search supplies the fields available in Aggregation field. For example, a search with user names can support one group per user, while a network search might use a source address. Check the aggregation selection again if you change the saved search.

Choose a monitor type and threshold

Changing Monitor type resets its threshold, aggregation field, and any Max count value to that type’s defaults. Recheck the matching fields before saving.

For Maximum, leave Do not aggregate selected to compare the total result count. Choose an aggregation field to evaluate each distinct value separately. With aggregation selected, Max count appears: it limits how many matching groups are evaluated in a run, from 1 to 100, with a default of 20. Reaching that limit reports an error because additional matching groups may exist.

This existing monitor groups by user.name. Threshold controls matching counts; Max count controls how many matching groups are evaluated.

For Minimum, no aggregation field is used. Its default threshold is 100.

The screenshot shows an unsaved type change in an edit form. A Minimum threshold of 100 matches a result count below 100.

For Change, choose the required field in Aggregation field and enter the number of changes allowed before the condition matches. Its default threshold is 5.

This Change draft shows the type and threshold. Select a real aggregation field before saving; Do not aggregate is not sufficient for this type.

For Unique Count, select the field whose distinct values should be counted. The field is required and the default threshold is 10.

Choose a field such as a user name or address according to your saved search, then review the distinct-value threshold.

Set the schedule in Advanced

Expand Advanced to set evaluation frequency, daily hours, active days, and repeated-event behavior. Scroll inside the form to see the complete section.

Advanced settings belong to the monitor being created or edited. They take effect when the form is saved.

The daily start/pause defaults cover 12:00 a.m. through 11:59 p.m., with all seven days selected. The same initial used for Tuesday/Thursday and Sunday/Saturday makes the hover text useful when selecting days.

Limit repeated events with Cooldown

Enable Cooldown when an ongoing condition should not create another normal event on every evaluation. Then set Time between events with the slider. The duration is 1–120 minutes, with a default of 15.

The monitor continues evaluating during cooldown. Matching evaluations can be recorded as skipped rather than creating another normal event.

Once the cooldown ends, a later matching evaluation can create another event. Disable Cooldown if every matching evaluation should be allowed to generate a normal event.

Delay an event with Pause and collect

Enable Pause and collect to wait after an initial match and include additional activity. Set Event generation delay from 1 to 120 minutes, with a default of 15. At the end of the delay, NeQter evaluates an expanded time window and creates an event only if that evaluation still matches.

Cooldown and Pause and collect cannot be enabled together. Turn off the current choice before enabling the other.

Save or discard a monitor draft

Select Save at the bottom to validate and save the configuration. The form requires a valid name, a saved search, and an aggregation field for types that require one. Correct any validation messages and save again. A new saved monitor begins participating in its configured schedule; an edited monitor uses the updated configuration for future evaluations.

Use Cancel or the upper-right X to discard unsaved form changes. Choosing types, toggling Advanced options, or changing day badges in this form does not save them by itself.

After saving, locate the monitor in the list and open Details. Review later runs, event outcomes, and errors to verify the saved search and threshold behave as expected. Configure an Alert separately if generated events should be sent to email or a webhook.

Start from a template

Select Start from a template for a prefilled configuration. The chooser groups templates by source or integration. The available groups depend on the data views present in your system.

Use the search field or expand a source heading to locate a suitable starting point.

Type into the search field to match template names and descriptions. Matching sections expand while you search. Select a group’s arrow to view its templates, read the description, and choose Use template beside the desired item.

Use template opens a draft. It does not create a running monitor immediately.

Review the prefilled New monitor form. Confirm its name, severity, time window, saved search, type, threshold, grouping, and Advanced settings match the intended use.

Review the selected saved search and all matching fields before saving a template-based monitor. The filled form illustrates the editor.

Select Save to create the monitor after reviewing the complete form, or Cancel to discard it. A template does not create or repair a missing saved search, so confirm that its selected search exists and is appropriate for your collected data.

Open Monitoring help

Select Help beside the Monitoring page title for an explanation of the workflow, page controls, status meanings, basic fields, matching types, and Advanced settings. Scroll inside the help panel to reach each section.

Help is available while reviewing Monitoring. It explains both the page controls and how the monitor’s evaluation settings work.

Use Close at the bottom or the upper-right X to return to the page.

Events

Open Events → Events to investigate the records NeQter has generated. This page combines monitor results with appliance, user, host, configuration, and service events. Use Monitoring to change the rules that evaluate saved searches; use Alerts to choose which generated events are delivered to recipients.

Read the overview and choose a time range

Open a legend entry to use Filter for value (plus) or Filter out value (minus). These add a filter to the page. The color swatches change that series’ display color. For example, the High severity legend entry lets you include or exclude High events.

Time selections and filter pills affect both charts and the event table. Text entered in the table’s Search bar filters the table only. Keep this distinction in mind when the rows shown differ from the chart distribution.

Use the event table

Scroll below the charts to see the event rows. The table initially displays the newest events first, with 20 rows per page.

The default filter NOT event.code: 9999 hides records created when a monitor matched but normal event creation was skipped. The default NOT status.active: false hides dismissed records. Remove the relevant pill when you need to investigate skips or review earlier dismissals.

-- means that a field has no displayed value for that event. Open View event when a cell is shortened or you need the full context.

Build a precise filter

1. Select Add filter.
2. Search for and select a Field, such as event.code.
3. Choose an Operator.
4. Enter or select the required Value or range bounds.
5. Optionally enable Create custom label? and supply a recognizable label for the pill.
6. Select Save to apply this page filter, or Cancel to discard the filter draft.

Available operators and suggested values depend on the field type. Changing the field resets the operator and value choices. A filter’s Save applies it to the current view; it does not create a saved search or edit an event.

For supported fields, table-cell actions also offer Filter for and Filter out for the displayed value. For an empty cell, these use field-existence conditions. If a query is invalid, correct the error shown by the table or clear the search and press Enter.

Choose the fields you want to see

Open N columns hidden. Use its search field to find a column, then turn its switch on or off. Show all enables all available fields; Hide all clears the displayed selection. Drag a field’s handle to change its order.

Open a column heading’s menu to use Hide column, Move left, or Move right. Hidden fields remain in the event record and are still available through the column selector and event details.

Investigate an individual event

Select the eye icon in a row. The flyout presents the event record, then any additional sections available for that event type.

Some events include Additional information in JSON form. Expand it when you need details such as the original monitor configuration or run identifier. The code block’s Expand icon enlarges the view; Copy copies its contents. Available sections depend on the event type.

A monitor-generated event can also show Monitor results summary, Results for monitor, and Logs for saved search. Review the saved search, threshold, hit count, index, and aggregation field/value to understand why the monitor matched. Go to discover opens the saved search in a new tab for further investigation.

A stored event and a fresh query of its underlying logs can show different amounts of information. If a contextual section has no results, check its selected time window and the availability of source data before interpreting it as evidence that the original event did not occur.

Dismiss reviewed events

Dismissal marks a record as dismissed while retaining it for later review. It does not correct the underlying condition or stop the monitor from evaluating future data.

1. Review the event and its supporting information.
2. Use the row’s Dismiss event, the flyout’s Dismiss, or select rows and choose Dismiss selected.
3. Check the target event or event count in the confirmation.
4. Enter an optional Dismiss reason explaining the review or action taken.
5. Select the final red Dismiss to update the record. Cancel or the close button exits without changing its status.

Dismiss all applies to active events in the loaded result set, not just the visible page. The main Events table loads up to 10,000 rows. Narrow the time range and filters, and review the confirmation count before using a bulk dismissal. Remove the NOT status.active: false filter to find dismissed records afterward.

Export event records

Select Export above the table to download CSV immediately. It contains all currently loaded rows, regardless of checked rows, the current pagination page, or hidden columns. The export includes the available event fields, including identifiers such as _id and _index.

The matching count can exceed the table’s 10,000-row loading limit. For a complete export of a large period, narrow the time range or filters into smaller result sets. For a formatted report of one event, use that event flyout’s Download button instead. Scheduled and historical reports have their own Reports guide.

Alerts

Open Events → Alerts to manage delivery rules. NeQter checks these configurations when it creates an event. A matching rule delivers the event to its configured email addresses or webhook destinations. Global administrators can view and manage these configurations.

The screenshot appliance has no saved alert configurations. The examples below use unsaved drafts to show the available controls; no email or webhook configuration was created.

Create an alert rule

1. Select Create alert configuration.
2. Enter an Alert name that describes the events and intended destination.
3. Select Alert rule type: Event codes or Event severity.
4. Choose the codes or minimum severity that should generate a notification.
5. Choose Output type, then add the matching email or webhook destinations.
6. For email, review the template, subject, and triggering-event options.
7. Select Save to create the delivery rule. Cancel or the flyout’s close button discards the draft.

Match specific event codes

Choose Event codes, then open the code selector. Search for a code or event name and select the appropriate items. The menu includes Monitoring codes and System event codes. Remove an unwanted selected item with its remove control.

For example, select a particular monitor’s code when you want notifications from that monitor regardless of unrelated events elsewhere in the system. Use the code shown on the Monitoring page or in an event’s details to identify the intended source.

Match a minimum severity

Choose Event severity to expose its severity selector. The available order is None → Low → Medium → High → Critical. A rule set to High matches both High and Critical events. None is the lowest threshold; it does not disable the rule.

Deliver by email

Choose Email, enter each recipient in Alert destinations, and press Enter to add it. NeQter sends a matching alert to every address listed. Duplicate destinations are rejected. The example address below is part of an unsaved draft.

Deliver to a webhook

Choose Webhook, enter a valid HTTP or HTTPS endpoint in Webhook destinations, and press Enter to add it. Repeat for additional endpoints. NeQter sends JSON to every listed URL and adapts the payload for supported services. Select the destination’s × to remove it from the draft.

Webhook and email destinations belong to their respective output types. If you switch the output type, add and review the new destinations before saving. An alert rule’s match fields select generated events; monitor schedules, lookback windows, and thresholds are configured under Monitoring.

Maintain and troubleshoot delivery rules

After rules exist, review their Codes / severity, Output type, and Destinations together before editing. A severity change can affect which severity-based delivery rules match future events. Deleting a configuration removes that delivery rule while retaining the underlying monitor and event records.

If an expected notification is absent, first confirm that an event was generated in the Events page. Check its code and severity against the alert rule and verify the destination. 1904: Alert delivery failed identifies a failed alert delivery; inspect that event’s details for the reported failure. Creating an alert configuration does not itself generate a monitor event.

System events

Open Events → System events to review NeQter’s built-in event definitions and their severities. Each definition explains what causes that event. Use the Events page when you want to search the actual records generated from these definitions.

Change the severity of future system events

1. Find the event by code or name. The browser’s Find command can help locate an entry in the long list.
2. Read its description and Default severity.
3. Open Change severity and choose the intended level.
4. Check the updated selection and success message.

Choosing a level saves the change immediately. There is no separate Save button or confirmation. The override affects future events; it does not rewrite the severity of older event records. To return to the baseline severity, select the level shown by Default severity.

Choose levels consistently with the alert rules your team uses. For example, a future event raised from Medium to High can start matching a High-and-above alert rule.

Find the relevant event family

The catalogue includes these groups. Read each entry’s description for its exact trigger.

The Host monitor up/down entries illustrate why some rows have no selector. Their descriptions direct you to the host monitor’s settings to configure severity. Use Hosts → Monitor for those controls.