Use the Events Viewer

When you investigate a security finding, high-level summaries only tell part of the story. To figure out exactly what happened, you often need to look at the underlying data that triggered the detection.

The Events Viewer is an interactive side panel that lets you dive directly into the individual Unified Data Model (UDM) events and raw logs that triggered a detection. By analyzing these records, you can verify suspicious activity, map attacker behavior, and gather the technical indicators needed for incident response.

To understand the broader triage workflow, see Investigation and case management overview.

Access event details during an investigation

You can open the Events Viewer from any workspace context where you are actively reviewing detections or case timelines:

• From the Case List View: Expand a case row, click a specific detection to open its summary drawer, and select the Events tab.
• From the Full Detection Page: Navigate to a dedicated detection view and go to the Events section at the bottom of the page.
• From the Case Overview: Select a case and locate the UDM Events widget to view events directly tied to the overall investigation.

Clicking any event row in these tables instantly opens the detailed Events Viewer panel.

Analyze evidence using event fields and raw logs

The Events Viewer organizes event data into two tabs, letting you pivot between structured platform data and the original source telemetry.

Validate activity with structured event fields

The Event fields tab translates complex log data into clean, parsed UDM objects. This view is ideal for quickly identifying key security indicators without sorting through unformatted text.

• Isolate critical attributes: Use the inline filter to quickly search for specific UDM paths, such as target hostnames, source IP addresses, or user command lines.
• Customize your analysis view: Add or remove UDM fields as columns to tailor the event table to your immediate investigative needs (for example, adding file hashes when investigating malware execution).

Inspect original telemetry with the raw log

The Raw log tab displays the unparsed, original JSON or text payload exactly as it was received from the source device.

• Verify parser accuracy: Cross-reference the parsed UDM fields with the raw payload to ensure critical context wasn't dropped or misclassified during ingestion.
• Extract deep technical context: Look for vendor-specific metadata or specialized error codes that might not map directly to standard UDM fields but are crucial for determining an attack's success.

Take investigative actions from the Events Viewer

As you isolate key indicators within the Events Viewer, you can take immediate action on individual records or rule groups to streamline triage and tune detection logic:

• Pin items as core evidence: Expand the event entries down to the lowest level of the row hierarchy and mark the checkbox next to the specific record. Click the pin icon that appears. This action copies the item directly to the Pinned section of your case workspace for historical timelines and executive summaries.
• Create detection exclusions: Mark the checkboxes next to one or more rows and click Create Exclusion to open the configuration dialog. Exclusions filter out detections that meet your specified conditions. You can configure exclusions at two levels:
  • Rule Set level: Select an entire rule group to apply the exclusion conditions across all rules in that group simultaneously.
  • Individual Rule level: Expand the rule set group and select specific, individual rules to isolate your exclusion parameters.
• Manage exclusion status upon creation: Toggle the Enable exclusion upon creation setting depending on your deployment needs:
  • Leave the setting enabled to apply the exclusion logic to live platform traffic immediately upon clicking Create.
  • Disable the setting to save your exclusion logic to the platform without activating it. This lets you safely store, edit, or test your logic later without altering current detection behavior.

For more details on managing exclusion rules, see Manage rule exclusions.

Troubleshooting

Use this table to quickly resolve common issues encountered while viewing event details:

Need more help? Get answers from Community members and Google SecOps professionals.