Managing large volumes of Enterprise Data Loss Prevention (E-DLP) incidents across multiple channels can make it challenging to locate specific incidents that require immediate attention. Sifting through hundreds or thousands of incidents to find those matching complex criteria such as excluding specific asset types, filtering by multiple channels, or combining severity levels with file patterns consumes valuable time and delays your incident response.

You can now use advanced filtering to construct sophisticated queries using SQL-like filter syntax. The advanced filter mode provides intelligent autocomplete suggestions for filter keys, operators, and values, so you can build complex queries such as:

Asset != 'http-put-post' AND Severity IN ('Critical', 'High')

Asset CONTAINS('pdf', 'txt') AND Channel = 'NGFW'