Show or Hide Results - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide

Creation date
Last date published
User Guide

As an alternative to building a filter query from scratch or using the column filters, you can pivot from rows and specific values to define the match criteria to fine-tune the results in the table. You can also pivot on empty values to show only results with empty values or only results that do not have empty values in the column from which you pivot.


CMD fields are limited to 128 characters. If you pivot on a CMD field with a truncated value, the app shows or hides all results that match the first 128 characters.

The show or hide action is a temporary means of filtering the results: If you navigate away from the page and later return, any results you previously hid will appear again.

This option is available for fields that have a finite list of options.

To hide or show only results that match a specific field value:

  1. Right-click the matching field value by which you want to hide or show.

  2. Select the desired action:

    • Hide rows with <field value>

    • Show rows with <field value>

    • Hide empty rows

    • Show empty rows