How to use "name-of-threatid" for threat types like "spyware"

[Arman_Zaheri]

Hello,

I want to filter Panorama Monitoring results based on the field "name-of-threatid" for threat types like "Spyware". But when I click on of the results, I get a filter like this: "... and ( name-of-threatid eq 'Grayware:ZZZZZ.com' )" but when I want to apply this filter I get this error:

It seems this field only accepts numbers. Do you have any idea what should I do about this?

Thank you

[Rick-Rowe · Accepted solution]

Add column of 'ID' for the monitor threat logs and then use that spyware ID to filter on.

exa.

'Microsoft Windows NTLMSSP Detection'  = ( threatid eq '92322' )

[Arman_Zaheri]

And just a note! This problem is only in Panorama, in Cortex Data Lake it works like a charm!