Skip to main content

Filters

N
Written by Nataliia Pukaliak

Filters are intended for filtering out events before rule matching, e.g. to reduce false positives:

  • Filters are applied before rule matching

  • Events that match the Filter condition are excluded from rule matching

  • Multiple Filters can be combined (with the AND logic)

  • Filters use the same syntax as Sigma detection conditions, e. g. 

    detection:
      condition: selection
      selection:
        EventID: 4624
        LogonType: 3
        SubjectUserName|re: '.*\$'  # Exclude machine accounts

You can create and manage Filters on the Filters page.

Create Filter

  1. Go to the Settings → Filters page and click the New Filter button.

  2. Give the Filter a meaningful name.

  3. Add the filtering logic in the Filter (YAML) editor.

  4. Click the Create button.

Edit or Delete a Filter

To edit a Filter:

  1. Go to the Settings → Filters page and click the name of the Filter you want to edit or the eye icon next to it.

  2. Make edits to the configuration and click the Update button.

To delete a Filter:

  1. Go to the Settings → Filters page and click the name of the Filter you want to delete or the eye icon next to it.

  2. Scroll down to the bottom of the page and click the Delete button.

  3. Confirm the action.

Note:

  • You cannot delete a Filter that's added to a Pipeline. First, remove the Filter from all Pipelines, and then delete it.

Related Articles
Did this answer your question?