There are 5 different entity types that can be added to the What tab:
- Subsystem
- Event Class
- Object Class
- Severity
- Result
Adding multiple items of the same entity results in the list being treated with an OR condition. For example if you add the 'User account disabled' and the 'Description changed on user object' events to the What tab, CA will search for 'User Account Disabled' OR 'Description changed on user object' as they are both from the Event Class entity. Even though the Subsystem entity has different Subsystems (Active Directory and File System for example), multiple Subsystem types, and the entries in each subsystem, added are also treated with an OR condition.
Multiple Entity types added to What tab are treated with an AND condition. So if the What tab has items from the Event Class and from the Object Class entities, CA will search for entries that contain at least one item from both entities.