Filters | Help Center

Overview

Filters are extra conditions you can add to the detection logic before deployment. Use them to exclude or include certain factors, such as specific users or hosts.

Filters are set up for specific platforms and their available content types. You can apply Filters:

On a Detection Rule page before downloading or launching/deploying the code
As part of Presets. Link a Filter to the corresponding Preset and use it to automatically customize content deployed via Jobs. Learn more about Automation where you can apply Presets together with Filters
In Prime Architect when translating a Sigma rule

On the Filters page, you can see all Filters that are available to you.

Tab	Description
Global	Created by the SOC Prime Team and shared with the companies. Users without Admin privileges can only view or copy these Filters.
My	Created by you and not shared across your company. Filters listed on this tab are available only to you.
Company	Company-wide Filters shared across all company users.

All Filters are displayed as a table with the following columns:

Column Name	Description
Name	Name defined during filter configuration
Platform	Platform and content type associated with the Filter
Created By	User who created the Filter
Last Updated By	User who made the last update to the Filter
Created	Date of the Filter creation
Updated	Date of the last update to the Filter

You can look for existing filters using the Search bar.

Filter Settings

The settings used to create or edit a Filter are as follows:

Setting name	Required/Optional	Description
Filter Name	Required	Fill in the Filter name
Share it with my team	Optional	Set this checkmark to make the Filter available to other people from your organization
Platform	Required	Select the platform from available options: Microsoft Sentinel Microsoft Sentinel (YAML) CrowdStrike Next-Gen SIEM (Falcon LogScale) Elastic (Detection Rule (Lucene)) Elastic (Watcher Alert) Elastic (Detection Rule (EQL)) Elastic (Detection Rule (ES\|QL)) Coralogix Sumo Logic Google SecOps Splunk AWS Athena Graylog Hunters Crowdstrike Next-Gen SIEM (Query)
Filter Condition	Required	Use the predefined pattern to write the specific filter condition for the detection in the language format of the selected platform

Note:

Multiple filters will be combined into a single condition with elements joined by the OR operator:
- Filters are combined with an OR operator
- Each Filter is put in parentheses
- All Filters combined with OR are put in parentheses
This condition will be added to the detection condition with the AND operator. So, if a Preset contains two Filters dst_ip = "1.1.1.1" and dst_user = "john" AND src_user = "mary", the detection condition after applying the Filters will look like this:

((dst_ip = "1.1.1.1") OR (dst_user = "john" AND src_user = "mary")) AND DETECTION_CONDITION
If you want to exclude something, create an appropriate Filter condition with negation.

Create Filter

You can create Filters for specific platforms from the Filters page or from the Detection Rule page.

From the Filters page

Click the Account icon > Platform Settings and select Filters.
Click the Add Filter button in the upper right-hand corner.
Specify the Filter details.
Click the Create button.

From the Detection Rule page

You can create a new Filter or apply an existing one directly from the Filter dropdown on the Detection Code tab of the Detection Rule page.

To create a new Filter:

Go to the Search page and select a rule from the list.
On the Detection Code tab of a Detection Rule page, open the Filter dropdown and select the Create New Filter option.
Fill in the filter Name and Condition.
Click the Save Changes button.

When creating a query filter for Microsoft Sentinel, use the Prepend or Append toggle to specify where the filter expression should be applied relative to the base query:

Prepend – inserts the specified KQL operators or expressions before the base query.
Append – inserts the specified KQL operators or expressions after the base query.

These options allow you to modify the query without manually editing full query syntax.

Link Filter to a Preset

After creating a Filter, it becomes available as an option in the Filter field for the corresponding platform in the Preset configuration modal.

Note: Creating a Filter does not automatically link it to a Preset.

To link a Filter to a Preset:

Click the Account icon > Platform Settings and select Presets.
Select Add Preset or select the Edit button on the needed Preset record.
In the Preset configuration modal, select one or multiple filters in the Filters field for the previously selected platform.
Click the Create Profile or Save Changes button.

To learn how to create Presets, go to this guide.

Edit or Delete a Filter

You can edit or delete Filters created by you:

Go to the Account > Platform Settings > Filters page.
Select the tab with your Filter:
- My if it was you who has created the Filter
- Company if the Filter has been shared by your teammate
Filters on the Global tab can be only copied.
Click the three dots on the right and select Edit or Delete.
Update the Filter settings and save changes, or confirm the deletion.

You can also edit Filter on the Detection Rule page:

Go to the Search page and select a rule from the list.
On the Detection Code tab, in the Filter dropdown, select the Edit icon on the desired Filter name.
Make the necessary edits and select Save Changes.