There are two ways to filter the data in the Cato Management Application (CMA) dashboards and show the items that are most relevant: automatically update the filter with the selected item, or manually configure the filter.
Automatically Filtering for an Item
As you hover over an item or field where a filter option is available, the 
button appears. Click the icon to show the filter options:
Add to Filter - Adds the item to the filter, and the dashboard now only shows data that includes this item. For example, if you filter for the specific user, the page only shows threat data that is related to that user. No other threat data is available until you change or clear the filter.
Exclude from Filter - Updates the filter to exclude this item, and the dashboard now only shows data that does NOT include this item.
View Events - Adds this item to the filter, and the Events page opens and shows all the events that match the filter.
You can continue to add items to the filter, click again to update the filter and drill-down further.
Manually Configuring the Filter
You can manually configure the filter for greater granularity to analyze the threat activity. After you configure the filter, it is added to the filter bar and the page is automatically updated to show the threat data that matches the new filter.
To manually configure a filter:
In the filter bar, click the plus symbol.
Start typing or select the Field.
Select the Operator, which determines the relationship between the Field and the Value you are searching for.
Select the Value.
Click Add Filter. The filter is added to the filter bar and the dashboard is updated to show results based on the filters.
Clearing the Filter
You can remove each item in the filter separately, or clear the entire filter.
To clear the filters for the dashboard:
To clear a single filter, click the X next to the filter (item 1 above).
To clear all the filters, click X at the right end of the filter bar (item 2 above).