You can use the Lacework Polygraph Diff filter to compare events from two different hours.
- The Diff filter is located in the upper right-hand corner of the Polygraph.
- When the filter is in the default state, select the initial hour in the timeline at the bottom of the Polygraph by clicking the area above the hour. This highlights the area with a blue bar.
- Mouse-over the Diff filter and select one of the following view types to display.
- Show Graph Union—This option displays three things for the events. Blue lines represent the initial hour selected, purple lines represent the hour being compared, and gray shows the events the hours being compared had in common.
- Show Graph Intersection—This option displays only the events the hours being compared had in common.
- Show Graph Difference—This option only displays the events respective to the hours being compared. The blue lines represent the initial hour selected and purple lines represent the hour being compared.
When viewing one of these filters, you can click another hour in the timeline at the bottom of the Polygraph to change the hour being compared. This highlights the area with a purple bar.
The event names highlighted in purple are those that match your search criteria.
The Polygraph search function supports the following types of queries:
((alice bob) OR (charlie david))
((alice AND bob) OR (charlie AND david))
(alice AND bob) OR (-charlie)
Always capitalize operators such as