Filters & Search¶

Parapet Security provides powerful filtering and search to help you find exactly the alerts you need.

Quick Filters¶

Quick filters appear above the alert table:

┌─────────────────────────────────────────────────────────────────┐
│  🔍 Search alerts...                                           │
├─────────────────────────────────────────────────────────────────┤
│  Severity: [All ▼]  Category: [All ▼]  Status: [All ▼]         │
│  Date Range: [Last 7 days ▼]                                    │
├─────────────────────────────────────────────────────────────────┤
│  Showing 156 alerts                        [Clear Filters]      │
└─────────────────────────────────────────────────────────────────┘

Filter Types¶

Severity Filter¶

Filter by alert severity:

Category Filter¶

Filter by threat category:

Triage Status Filter¶

Filter by AI triage status:

Notification Status Filter¶

Filter by notification status:

Date Range Filter¶

Filter by when alerts were received:

Search¶

The search box searches across:

• Alert title
• Description
• Affected entities (hosts, users, IPs)
• MITRE mappings
• Raw payload content

Search Syntax¶

Search Examples¶

Combining Filters¶

All filters work together with AND logic:

Saving Filter Presets¶

Save frequently used filter combinations:

1. Set your filters
2. Click Save Preset
3. Give it a name (e.g., "Critical malware this week")
4. Access from the Presets dropdown

Preset Examples¶

Exporting Filtered Results¶

Export your filtered alerts:

1. Apply your filters
2. Click Export
3. Choose format:
4. CSV - For spreadsheets
5. JSON - For programmatic use
6. Choose scope:
7. Current page - Just visible alerts
8. All matching - All filtered results

Filter URLs¶

Filters are reflected in the URL, making them shareable:

https://app.parapetsecurity.com/alerts?severity=high&category=authentication

Share this URL with teammates to show them the same filtered view.

Tips for Effective Filtering¶

Finding Specific Incidents¶

1. Start with a broad date range
2. Add severity filter for urgency
3. Use search for specific indicators

Daily Review Workflow¶

1. Filter: Last 24 hours + High/Critical
2. Review and act on matches
3. Filter: Medium + Unreviewed
4. Triage the backlog

Incident Investigation¶

1. Search for the IP/host/user involved
2. Expand date range to see history
3. Check related alerts
4. Export timeline for documentation

Reducing Noise¶

1. Identify frequently dismissed alerts
2. Note the patterns (source, rule, etc.)
3. Adjust SIEM rules or notification thresholds

Keyboard Shortcuts¶

Next Steps¶

• Configure Notifications - Alert on what matters
• Understand Alert Details - Dive deep into alerts
• Troubleshoot Issues - If filtering isn't working