Filtering the Microsoft 365 Protection Page

You can filter the O365 to concentrate on the Microsoft 365 information you most want to see. You can filter out the data you don't want to see to more easily find the data you're interested in.

Filters are active until you remove them, even if you navigate to another page. When you return to the Microsoft 365 Protection page, the filter will still be in place.

The difference between filters and quick filters

You can create filters in two ways:

• Adding a filter
• Creating a quick filter

Adding a filter lets you select a wider variety of subjects to filter on, including action, application, date range, ISP, keyword, location type, outcome, source city, source country, source IP address, source state/region, and user. Adding a filter also lets you create exclusion filters. For more information, see the Exclusion Filter section below.

Creating a quick filter is faster, but your options for creating them are more limited. For example, you can create a quick filter by clicking on an origin country on the Microsoft 365: Login Events map or clicking a row in the ISP table.

Exclusion filters

You can also create filters that exclude the values that you choose, so everything is displayed except for the chosen values. For example, if you select a date range of one month and then negate that condition so that all data from earlier than one month are displayed.

Filter operators

When you add filters, you have the choice to use an And or Or operator. The operator is applied to all the filters you add.

To create a filter

1. In  Barracuda XDR Dashboard, click Intelligence  > O365 .
2. Click  Add Filter.
3. In  Field, select an option.
4. In  Value, select an option.
5. Optionally, if you want to exclude the values you chose in the  Field  and  Value  fields, enable the  Negate this condition  check box.
6. Click  Apply Changes.
7. Repeat steps 2-6 until you have added all the filters you want.
8. Optionally, in the  Filters  area, click one of the following filter operators:
   • And
   • Or

To create a quick filter from the Login Events map

When you create a quick filter from the Login Events map, the page is filtered by logins from the country you choose.

1. In Barracuda XDR Dashboard, click Intelligence > O365 Protection.
2. In the Microsoft 365: Login Events map, click any country with a login dot to filter by that country.

To create a quick filter based on the Timeline Graph

When you create a quick filter from the Timeline Graph, the page is filtered by Success or Failure.

1. In Barracuda XDR Dashboard, click Intelligence > O365 Protection.
2. In the Timeline graph, click Success or Failure in the legend.

To create a quick filter based on the Country, Source IP, ISP, or User table

1. In Barracuda XDR Dashboard, click Intelligence > O365 Protection.
2. In Country, Source IP, ISP, or User table, click a row to filter on the information in that row.

To create a quick filter based on the Login Events table

When you create a quick filter from the Login Events table, the page is filtered by the information in the row you select. Some of the filter options include:

• User
• Action
• Outcome
• Application
• Source IP
• Location
• Known Location
• ISP

1. In Barracuda XDR Dashboard, click Intelligence > O365 Protection.
2. In Login Events table, click a row.

3. In the Message Details popup, click the row you want to filter on.

   You can filter on the rows where a magnifying glass iconappears when you hover.