The Advanced Search pane enables you to customize a search for files, hosts, users, and network traffic, based on any of the available metadata parameters. Under Advanced Search you can also customize the displayed fields in the inventory list on any Forensic page. For more information on the fields displayed by default in the Forensic page, see Default Forensic Display.Customizing the DisplayYou can modify the inventory list on the forensic pages to display additional columns. To add or remove columns, select/clear the fields in the Display Fields menu, then click Search to refresh to data.You can also sort the display by each field by clicking the arrows next to the column title. By default, the items are not sorted by any specific order.Search FieldsYou can add any field that appears in Display Fields as a search parameter in the Search Fields window (even if the field is not selected). To add a parameter, in the Display Fields menu, click  by the field name.To search the Forensic page:From the dropdown menu, select a logical operator for each search parameter.Enter a value for the search parameter.To remove a parameter from the search, click.Click Search.The inventory list is filtered according search parameters.Save the search by clicking Save Search, then entering a search name.Once the search is saved you can:Add it to to Favorite Searches, by clicking.Delete it, by clicking X.Relative TimeThe Advanced Search page includes a Relative Time filter used to search for results within a defined number of minutes from a current time. This filter is very useful for conducting a real-time incident response and ensures that only the most relevant results are shown. To apply a Relative Time search, use the Last Seen and First Seen fields.