This article provides a quick reference to filtering and downloading your events.

Estimated reading time: 1 minute

You can filter your events by attribute, and then download a CSV of the results.

In Red Canary, click Events.
Enter attributes in the Analyzed events filter bar, and then hit Return or Enter.
Click the download button, and then click Download to CSV (last 1500 events).

Supported filter attributes

Attribute	Description	Example
MAC address	A MAC address associated with the event.	`00-14-22-01-23-45`
IP address	An IP address associated with the event.	`127.0.0.1`
Endpoint users	A user on an endpoint associated with the event.	`joe`
Command line	A command line, process hash, or filename associated with the event.	`powershell.exe`
MD5/SHA256	An MD5 or SHA256 hash associated with the event.	`1a79a4d60de6718e8e5b326e338ae533`

Filtering events