Using watchlists in Advanced trave views
Inside the enVision online help there is a topic called "Advanced Table Trace View (RSA enVision Event Explorer)" take a look to that topic to see if that is what you are looking for.
I hope this helps.
Here is the format for using the watchlists in the traces
DEVICETYPENAME IN ('Windows Events (NIC)')
AND EVENTCATEGORYNAME LIKE 'User.Management.Groups.%' AND IN_Watchlist ("GROUP",'Windows High Profile Groups')