You are reviewing a UDM search result and find that the default columns are not helpful. Which action should you take to quickly surface relevant data?

• A. Use the columns feature to select/remove columns relevant to your analysis.
• B. Download as CSV and manipulate in a spreadsheet.
• C. Create a SIEM dashboard based on the search.
• D. Select events, choose UDM fields from event view checkboxes, copy/extract/analyze, refine query.

Answer: (A)

Adjusting the columns shown in your search results is the fastest way to surface the data that matters. The default view often includes many fields you don’t need, which makes it harder to spot the relevant signals. By using the columns feature to pick the UDM fields you care about and remove the rest, the result list updates immediately to highlight the key information you’re analyzing—timestamps, hosts, users, event types, and other critical attributes—without leaving the search or performing extra data transformations.

Other options require more steps and aren’t as quick for this goal: downloading as CSV moves you out of the live view and adds manual manipulation; building a SIEM dashboard is useful for ongoing monitoring but involves setup and isn’t a quick fix for a single search; manually selecting events and copying/extracting fields is tedious and prone to missing context, making it slower to rapidly surface relevant data.