---
title: "Users"
canonical: "https://docs.infoblox.com/space/BloxOneThreatDefense/35406094/Users"
format: markdown
---
The *Users *tab includes security data associated with the users on your network. You can view of users identified from your network traffic. To export the All *Users *table data in csv format, click **Export**. The default file name is *security-activity_users.csv*. Exported data is limited to 10,000 records.
## Performing Search Queries
The search feature supports using queries to perform searches using the integrated search query language. Using the search query language, you can search all records in the *Security Events* report with customized queries. Using the search query options available in the *Users *report, you can:
- Run a search on any of the following fields:
- **ACTION**
- **CLASS**
- **DEVICE NAME**
- **DHCP FINGERPRINT**
- **DNS VIEW**
- **FEED**
- **MAC ADDRESS**
- **OS VERSION**
- **POLICY**
- **PROPERTY**
- **QUERY**
- **QUERY TYPE**
- **RESPONSE**
- **SOURCE**
- **USER**
- **THREAT_CONFIDENCE**
- **THREAT_LEVEL**
- The** =** and the **NOT (!=)** operators
- Use **AND** and **OR** operators.
- Use **single** and **double **quoted to enter values with spaces.
- Use parentheses to group search parts.
- Use the **wildcard symbol (*) **as the last character of the search value for a partial match.
- Use the **ENTER** key to apply search.
- Use the **TAB** key to autocomplete search with the first available suggestion.
## Sample Search Queries
The following are search query examples:
- *query=domain.* AND device=52.123**
- device=office.1.domain.com OR device=office2.domain.com
- dns_view=example-view AND query_type=A
- (source= Infoblox Endpoint’ OR source=“example 1”) AND device=52.123*
Search by the query fields matches values by subdomains. E.g. query = domain.com
matches
'domain.com', 'office.domain.com', 'space.office.domain.com
> ⚠️ **Note**
> ⚠️
> ⚠️ All search values are case sensitive. A maximum of five operators can be used when constructing a query search.
## Filtering the Users Tab
To filter All *Users *events by specific criteria, select the applicable objects from the following drop-down menus located below the top action menu:
- **Level**: The threat level measured on a scale from 0 to 100.
- **Policy**: Active security policies.
- **Source**: The location of the device within the network infrastructure. For example, the device can be an **on-prem** appliance or an **endpoint** device. You can select which records to view by selecting or deselecting from among the options available.
- **Show**: Security and activity events can be filtered by choosing an option from the **Show** drop-down menu.
The *All Users *table displays the following information by specific criteria, select the applicable objects from the following column drop-down menus:
- **REQUESTS**: The request type. Clicking on the number of requests in the REQUESTS column associated with a device name allows you to pivot off the record and display all security events associated with the device name.
- **USER**: The user triggering the hit.
- **DEVICES**: The devices that triggered the hits. Clicking on the number of devices in the **DEVICE** column associated with a user allows you to pivot off the record and display all devices associated with the user.
## Export Records
Click **Export** to download a CSV file of report records. The maximum number of exported Users report records is **10,000**.