when I display a report (say alerts) and I then click on a category count I would expect to see just those alerts displayed but instead it seems to list all events.
looks like the search string is getting lost somewhere!
is the link but the server appears to be ignoring the q=…
BTW Jason would you rather I report stuff like this here or on the github site?
I now see what is wrong the url should be q=category%2B"Attempted%20User%20Privilege%20Gain"
This seems to be an issue in all the reports but when you examine individual events the links include the field name.
Hmm… Probably over at EveBox… Maybe with the GitHub discussions: Discussions · jasonish/evebox · GitHub (which isn’t much different than an issue).