The Events tab is the live, searchable stream of normalised audit events captured by the collector — the fastest way to confirm the pipeline is working and to investigate recent activity on the appliance.
¶ What each row shows
- Date — when the event occurred (UTC).
- Category — the assigned class:
authentication,account_management,privilege_escalation,kernel_module,network_change,audit_configuration, and so on. - Severity — a colour-coded badge from 0 to 5 (green/grey for low, orange for medium, red for high).
- Audit key — the key of the audit rule that produced the event (e.g.
modules,system-locale,identity,logins). - Executable — the program responsible (e.g.
/usr/bin/kmod,/usr/sbin/cron).
¶ Searching
Type in the search box and press Go! to filter the stream by category, audit key, executable or process name. Use it to answer questions like "show me every kernel-module load" or "what did /usr/bin/sudo do in the last few minutes".
The stream shows the most recent events held in memory. For long-term retention and correlation, forward events to a destination — this tab is for live inspection, not archival.