Customize the events view

Updated: August 31, 2026

Want to summarize with AI?

Configure the events view including event details, device status, reporting views, and follow-up actions.

Customize the events view to display only the columns and information that are relevant to your monitoring and analysis needs. This allows you to optimize the view for better performance and easier data interpretation.

Any changes made to the Event Logging page are automatically saved for when you navigate away from this page and come back at a later time.

Note

The Live and Historical events view have the same configuration. When you customize the events view, these changes are applied to both the Live and Historical view.

Procedure

	1.	Click the column filter icon located to the right of the columns. You can modify the event view for both live and historical events to only include column headers that apply to the view you want.
	2.	Select or deselect the columns you want. Columns with asterisks are provided within the event table by default, although you can remove them at any time. Figure 1. Show or hide columns
	3.	Click Apply.
	4.	Search for additional columns not part of the default list and add them to the event view. You can search for more columns, which are not part of the default list, and add them to the event view for both live and historical events. Note that adding many columns for customizing the table may reduce performance. Consider using fewer columns for faster data retrieval. Alternatively, click the + icon next to an event to expand it and view the hidden columns. Note that some of the event fields displayed when you expand an event can have a different name compared to the corresponding column name. To correlate the events fields displayed when you expand an event to the corresponding column name, see Correlate Threat Defense Event Fields and Column Names.
	5.	Reorder the columns by dragging and dropping them in the column filter menu. Click the column filter icon located to the right of the columns to view the list of selected columns. Then, drag and drop the columns into the order you want. The column at the top of the list in the drop-down menu appears as the left-most column in the event table.

The events view is customized with your selected columns and preferred order. These settings are automatically saved and will persist when you navigate away from and return to this page.

Correlate Firewall Threat Defense event fields and column names

On the Security Cloud Control Event Logging page, you can click on any event to expand its details and view all the associated event fields. Note that the names of some event fields may differ from those of the column headers in the Security Cloud Control event viewer where the values of these fields are displayed.

Table 1. Firewall Threat Defense Event Field and the Corresponding Security Cloud Control Column Name
Security Cloud Control Column Name	FTD Event Field
Date/Time	Timestamp
Detection Type	ClientAppDetector
Encrypted Visibility Fingerprint	EVE_Fingerprint
Encrypted Visibility Process Name	EVE_Process
Encrypted Visibility Process Confidence Score	EVE_ProcessConfidencePct
Encrypted Visibility Threat Confidence	EVE_ThreatConfidenceIndex
Encrypted Visibility Threat Confidence Score	EVE_ThreatConfidencePct
MITRE	MitreAttackGroups
NAT Source IP	NAT_InitiatorIP
NAT Source Port	NAT_InitiatorPort
Rule Group	SnortRuleGroups

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.