cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
720
Views
0
Helpful
1
Replies

Report needed for Red (High) Incidents only

kerry.kielty
Level 1
Level 1

Hi,

My boss would like me to be able to run a report that includes red (high) incidents only. I've looked through all of the possible reports and can't find anything remotely close to his request. Any help would be appreciated.

Thanks,
Kerry

1 Reply 1

Scott Fringer
Cisco Employee
Cisco Employee

Kerry;

  You should be able to create a query to gather only red severity events, and then make this query part of a report.

  In the query, you will want to click the "ANY" under the 'Events' column.  In the resulting pane, you will want to set the "Restrict to Severity" drop-down to "Red".  From there you can further tune the query to restrict it to specific reporting devices, events, etc.  This query should return only red severity events.  From there, you can make this query a report by clicking the "Save As Report" button.

Scott