---
locale: "en"
updated_at: "2026-07-08T13:50:29.058Z"
canonical: "https://www.isdecisions.com/en/fileaudit/docs/reference/filters"
---

# Filters

Filter fields shared across access reports, scheduled reports, and alerts

## Database, path and server filters

These filters scope a search to a server and one or more paths. They appear in **access reports** and **snapshot reports**, not in alert or scheduled report configuration.

| Field | Description |
| --- | --- |
| **Database** | The database to report on. Includes the production database and any archived databases managed by the application. |
| **Server** | Display events from a specific audited Windows or Cloud server. Auto resolves the server automatically from the path you enter. |
| **Path** | Restrict results to specific files or folders. |

![](https://a.storyblok.com/f/122374/874x644/954072e82c/filters-database-server-path.png)

The Path field supports wildcards: `*` matches any string, `?` matches any single character. To search several paths at once, set Server to **Auto**, then enter the paths separated by commas in the Path field.

> **Note**
>
> If you enter a path that is not currently monitored, FileAudit detects it and offers to set up the audit configuration through its wizard. Follow the wizard steps to configure NTFS auditing for the new path. See [Manage Windows audit](/fileaudit/docs/guides/operations/manage-windows-audit) Guide.

## What filters

The What filters select events by the nature of the operation and the type of object involved.

| Field | Description |
| --- | --- |
| **Access status** | Restrict results to Granted access, Denied access, or both.  An event is recorded for every attempted access, so a denied delete attempt appears as a Delete event with a Denied status. |
| **Object type** | Restrict results to files, folders, or both. |
| **Access type ** | Select one or more operations to match, such as Read, Write, Delete, or Rename. For the full list of access types, see [Access types](/fileaudit/docs/reference/core-concepts/access-types) Reference. |

![](https://a.storyblok.com/f/122374/874x644/fe338d34a7/filters-access-status-object-type.png)

## Who filters

The Who filters select events by the identity that generated them.

| Field | Description |
| --- | --- |
| **Domain** | Match events for a specific Active Directory domain, entered by its NetBIOS name. |
| **Group** | Match events generated by members of a specific Active Directory group. |
| **User** | Match events generated by a specific user. |

![Filter by domain, group and user](https://a.storyblok.com/f/122374/874x644/d987cdd9b0/filter-domain-group-user.png)

A few constraints apply to group selection:

- Groups without users (for example, a group containing only machine accounts) are not allowed.
- Groups from sub-domains or parent domains are not supported.
- After the service starts or restarts, it needs a short time to build the group list. During this interval, any group selection is rejected, usually for a few seconds.

The Group and User fields accept an **advanced syntax** to combine multiple identities, described in [Include or exclude users](#include-or-exclude-users) below.

## Include or exclude users

The Group and User fields support a syntax to include or exclude several identities in a single filter. Separate multiple entries with commas. Prefix an entry with a minus sign (`-`) to exclude it.

| Entry | Result |
| --- | --- |
| `Sales, Marketing` | All accesses by members of the Sales and Marketing groups. |
| `-Marketing` | All accesses by Everyone except members of the Marketing group. |
| `Sales, -Managers` | All accesses by Sales members, except users who also belong to Managers. |

In the combined case, if Sales and Managers share no members, all Sales members are included. If every Sales member also belongs to Managers, no data is returned.

## Source filters

The Source filters select events by where the access originated.

| Field | Description |
| --- | --- |
| **Client IP address** | The IP address of the machine that performed the access, when the access came through the network. |
| **Client name** | The name of the machine that performed the access, when the access came through the network. |
| **Process** | The name of the process that generated the access attempt. Applies only when the file or folder was accessed locally, on the machine hosting it. |

![Filter by client IP address, client name and process](https://a.storyblok.com/f/122374/874x644/5dac502dd3/filter-ip-address-client-name.png)

## When filters

The When filters define the time period covered by a **scheduled report**. Because a scheduled report runs repeatedly, these options are evaluated relative to each execution date, producing dynamic content on every run.

Several preset selection options are available. Choosing **Custom** unlocks granular control through the **From** and **To** dropdown lists, which include relative time options:

- Selecting **Event from** in the From list, or **Event to** in the To list, lets you define an exact boundary for the period.
- These selections enable the date and hour fields, where you set the start and, if needed, the end date and time.

For how to create and schedule a report, see [Manage schedules reports](/fileaudit/docs/guides/operations/schedule-reports) Guide.

## Frequency filters

The Frequency filters appear only when configuring a **Mass access alert**. They define the volume of matching events that triggers the alert, used to detect bulk copying, deletion, or movement by a single user.

| Field | Description |
| --- | --- |
| **Threshold** | The number of accesses matching the alert criteria, above which the alert triggers within the time period. |
| **Time period** | The rolling window over which matching accesses are counted. |
| **Latency period** | The time the alert stays disabled after triggering. Enter `0` to disable it, which causes the alert to trigger on every event that exceeds the threshold. |

![Filter by threshold, time period and latency period](https://a.storyblok.com/f/122374/953x410/f1992d2fca/filter-threshold-time-latency-period.png)

For how to create and tune alerts, see [Manage alerts](/fileaudit/docs/guides/operations/manage-alerts) Guide.

## File and Folder properties snapshot filters

Snapshot reports use a distinct set of filters, because they describe the metadata captured rather than access events.

| Field | Description |
| --- | --- |
| **Object Type** | Restrict results to files, folders, or both. |
| **Date type** | Match items by the date they were created, accessed, or modified. |
| **Period** | Restrict the report to a specific time period relative to the selected date type. |
| **Size type** | Match items by their size: `Total size` (full size of a file or folder including subdirectories), `Root size` (size of files at the root of a folder only), or `Compressed size` (compressed size of a file only). |
| **Larger than** | Minimum size threshold, in MB or GB, relative to the selected size type. |
| **Read-Only** | Match items whose Read-Only attribute is set. Display Yes, No, or both. |
| **Hidden** | Match items whose Hidden attribute is set. Display Yes, No, or both. |
| **Compressed** | Match items whose Compressed attribute is set. Display Yes, No, or both. |
| **Encrypted** | Match items whose Encrypted attribute is set. Display Yes, No, or both. |
| **Archived** | Match items whose Archived attribute is set. Display Yes, No, or both. |

![Filter by date, size and attributes](https://a.storyblok.com/f/122374/898x608/3242fdf54c/filter-date-size-attributes.png)

For how snapshots are generated and read, see [Manage permissions and properties snapshots](/fileaudit/docs/guides/operations/manage-permissions-and-properties-snapshots) Guide.

## Permissions snapshot filters

Snapshot reports use a distinct set of filters, because they describe the state of permissions rather than access events.

| Field | Description |
| --- | --- |
| **Inherited** | Match items whose permissions are inherited from a parent folder. Display Yes, No, or both. |
| **Permissions type** | Match items by their Allow or Deny basic permissions. Display Yes, No, or both. |
| **Owner** | Match items by their owner. |

![Filter by owner, inherited and permission type](https://a.storyblok.com/f/122374/832x459/e843b74cb7/filter-owner-inherited-permission-type.png)

For how snapshots are generated and read, see [Manage permissions and properties snapshots](/fileaudit/docs/guides/operations/manage-permissions-and-properties-snapshots) Guide.