Filters

^{Last Updated: 2026-08-27}

Purpose

This article describes how to use filters in the Outpost24 Portal to limit displayed data based on text, numerical values, dates, and other criteria.

Introduction

Filters limit the data displayed in Portal views based on specified criteria. Filters can be applied to one or more columns to locate specific entries or focus on data relevant to an investigation, analysis, or remediation task.

Use filters to search text values, compare numerical values, define date ranges, exclude results, or combine multiple criteria. Filters can be applied to visible and hidden columns, which allows the displayed columns and filtering criteria to be configured independently.

To access Filters, click the filter icon in the bar spanning along the left edge of the table. This displays the Filter panel.

Prerequisites

Access to the Outpost24 Portal and the relevant data is required.

Apply Filters

To access the filtering, click the filter icon on the top right side of the screen. A list of available columns is displayed:

Use the Find Column field to quickly find the column name of choice in the list of applied filters.

Applying Filter

Filters can be applied from the Filters panel or directly from supported column headers.

To apply a filter from the Filters panel:

1. Select the Filter icon to open the Filters panel.
   

   
   

2. Locate the column to filter.
   Use Find Column to search for a column.
   

   

   
   

3. Enter a filter expression for the column.
   
   

   

   
   

4. Add filters to additional columns as required.

Filter Expression

The following expressions are available for supported filter fields. Expression support depends on the field and its underlying data type.

AND and OR Expressions

AND and OR expressions can be combined.

For example:

a,b|c

returns:

(a AND b) OR c

The expression:

a,b|c,b

returns:

(a AND b) OR (c AND b)

Filter Numerical Values

Use <, >, or - to filter numerical data.

For example:

<6.4

returns non-empty values below 6.4.

>3.2

returns non-empty values above 3.2.

3.2-7

returns values from 3.2 through 7, including both boundary values.

These operators apply only to columns with compatible underlying data types.

Filter Dates Using Expressions

The < and > operators can also be used with supported date columns.

For example:

<2026-07-31

returns dates before July 31, 2026.

>2026-07-31

returns dates after July 31, 2026.

For more advanced date filtering, use the date filter.

Filter Hidden Columns

Filters can be applied to columns that are not displayed in the table.

This allows a view to display only the columns required for the current task while using additional columns as filtering criteria.

The filter counter indicates how many filters are currently applied to the table. Check the counter when the displayed results are more limited than expected, as a filter can remain active on a hidden column.

Date Filters

Date columns provide a dedicated date filter for defining time-based criteria.

Filter Modes

The date filter provides three modes:

• Quick — predefined commonly used date ranges.

• Relative — dynamic ranges calculated from the current date and time.

• Absolute — fixed dates and times.

Quick Date Filters

Predefined common date ranges for fast filtering:

Quick filters are dynamic and update relative to the current date and time.

For example, Yesterday represents the previous calendar day, while Last 24 hours represents a rolling 24-hour period from the current time.

Relative Date Filters

Relative filters define dynamic periods based on the current date and time. The calculated date range changes as time progresses.

The following modes are available:

Mode	Description
On	Returns data for the specified relative time period. Amount: Numeric value Unit: seconds, minutes, hours, days, weeks, months, or years Direction: "ago" (past) or "from now" (future) Rounding: Always enabled for "On" filters The filter creates a full period boundary. For example: "2 days ago" returns the entire day from 2 days ago (00:00:00 to 23:59:59) "1 week ago" returns Monday 00:00:00 through Sunday 23:59:59 of that week "3 months ago" returns the 1st through the last day of that month This allows filtering on complete time units relative to the current date/time. Visualization:
Before	Returns data before the specified relative date and time. Amount: Numeric value (e.g., 1, 2, 10) Unit: seconds, minutes, hours, days, weeks, months, or years Direction: "ago" (past) or "from now" (future) Rounding: Optional checkbox to align to unit boundary (e.g., "1 day ago" rounded = start of that day at 00:00) Example: "3 days ago" with rounding returns everything before 3 days ago at 00:00:00.
After	Returns data from the specified relative date and time. Amount: Numeric value (e.g., 1, 2, 10) Unit: seconds, minutes, hours, days, weeks, months, or years Direction: "ago" (past) or "from now" (future) Rounding: Optional checkbox to align to unit boundary Example: "2 weeks ago" returns everything from 2 weeks ago on. Matches future time too. With rounding enabled, it starts from the beginning of the week (Monday 00:00) from 2 weeks ago.
Between	Returns data between two relative date and time boundaries. From: Amount, unit (seconds/minutes/hours/days/weeks/months/years), and direction To: Separate amount, unit, and direction configuration Rounding: Optional checkbox applies rounding to both boundaries Each boundary is calculated independently, allowing flexible ranges like "2 days ago to 1 week from now" or "1 month ago to 5 days ago". Example: "Between 7 days ago and 1 day ago" with rounding returns everything from Monday 00:00:00 of last week through 00:00:00 of yesterday.

Filter Selection Priority

When opening the date filter panel, the widget automatically selects the most appropriate filter option based on your current selection. If your selected date range matches multiple filter types, the widget follows this priority order:

1. Quick filters (Today, Yesterday, This Week, Last Week, etc.)

2. Relative date filters (for example, "1 day ago", "2 weeks ago")

3. Absolute date filters (specific calendar dates)

Example: If you select "1 day ago" in the relative date filter, which matches the "Yesterday" quick filter, the widget will display "Yesterday" as the selected option when you reopen the date panel. The widget prioritizes showing the simpler quick filter option rather than the relative date configuration you originally selected.

This behavior also applies when:

• Loading saved view templates

• Refreshing the page with filters in the URL

• Switching between different views

• Reopening the widget for the same column

The widget always tries to display your filter using the simplest matching option from the highest priority category available.

Fields description

• Amount: Positive integer specifying the quantity of time units

• Unit: Time unit selector with options:

  • seconds

  • minutes

  • hours

  • days

  • weeks

  • months

  • years

• Direction:

  • "ago" - in the past (creates negative ISO 8601 periods like -P2D)

  • "from now" - in the future (creates positive ISO 8601 periods like P1W)

• Rounding: Optional checkbox to align timestamps to unit boundaries:

  • second: :00.000 milliseconds

  • minute: :00 seconds

  • hour: :00:00 (top of hour)

  • day: 00:00:00 (midnight)

  • week: Monday 00:00:00

  • month: 1st day at 00:00:00

  • year: January 1st at 00:00:00

Technical format: Relative filters are stored as ISO 8601 durations (e.g., -P2D = 2 days ago, P1W = 1 week from now, -P3M = 3 months ago).

Live preview: The filter displays a "Currently:" hint showing the calculated date/time in the selected timezone with the current configuration.

Absolute

Specific fixed timestamps that do not change over time.

When selecting a date in the filters, a date picker is displayed showing the calendar interface with the selected timezone at the top.

Date picker: Calendar based interface for selecting exact dates and times. Timestamps are stored with timezone offset information (e.g., 2025-11-18T10:00+01:00).

Use cases: Best for historical queries, compliance reporting, or filtering on specific known dates that should not shift over time.

Timezone

Date filters use the timezone selected in the date filter. The selected timezone determines how date and time boundaries are calculated.

The timezone selector displays the timezone name and UTC offset.

All date filters include timezone support via an autocomplete field at the top of the filter panel.

• Timezone format: Filters store timezone information:

  • Relative/Quick filters: |timezone(timezone_name) suffix (e.g., >-P1D|timezone(Europe/Stockholm)).

  • Absolute filters: +HH:MM offset appended to timestamps (e.g., 2025-11-18T10:00+01:00).

• Timezone display: Shows timezone name and UTC offset (e.g., "Europe/Stockholm (UTC+02:00)").

• Filter interpretation: All date comparisons are performed in the selected timezone, ensuring consistent results regardless of server or client timezone settings.

Select the appropriate timezone when filtering data across systems or environments in different geographical locations.

Technical Details

Stored format examples:

• Quick filter: >-P1D|timezone(Etc/UTC) (after today)

• Relative "On": -P2D|timezone(Europe/Stockholm)|round (on the day 2 days ago, rounded)

• Relative "Before": <-P1W|timezone(America/New_York) (before 1 week ago)

• Relative "Between": -P7D•-P1D|timezone(Asia/Tokyo)|round (between 7 days ago and 1 day ago, both rounded)

• Absolute "On": 2025-11-18T00:00+01:00

• Absolute "Between": 2025-11-01T10:00+01:00•2025-11-30T18:00+01:00

Filter modifier suffixes:

• |timezone(name): Specifies the timezone for relative/quick filters

• |round: Indicates rounding is enabled for relative filters

• +HH:MM or -HH:MM: Timezone offset for absolute timestamp filters

Column Filters

Filters can also be entered directly in supported column headers.

Enter a filter expression in the filter field at the top of the column. The same filter expression rules apply to column filters and filters configured from the Filters panel.

Clear Filters

Filters can be cleared individually or all at once.

Clear an Individual Filter

Select the X for the filter to remove it.

The remaining filters continue to apply.

Clear All Filters

Select the Clear filter icon to remove all filters applied to the table.

The Clear filters control is also available from the table view.

Clearing the Find Column search field only resets the column search in the Filters panel. It does not remove filters applied to the table.