diff --git a/docs/management/admin/event-filters.asciidoc b/docs/management/admin/event-filters.asciidoc index 94a64c0e43..99dcf2b3f5 100644 --- a/docs/management/admin/event-filters.asciidoc +++ b/docs/management/admin/event-filters.asciidoc @@ -16,12 +16,12 @@ IMPORTANT: Since an event filter blocks an event from streaming to {es}, be cons By default, event filters are recognized globally across all hosts running {elastic-defend}. If you have a https://www.elastic.co/pricing[Platinum or Enterprise subscription], you can also assign an event filter to a specific {elastic-defend} integration policy, which would filter endpoint events from the hosts assigned to that policy. -Create event filters from the Hosts page or the Event filters page. +Create event filters from the **Hosts** page or the **Event filters** page. . Do one of the following: + -- -* To create an event filter from the Hosts page: +* To create an event filter from the **Hosts** page: .. Select the *Events* tab to view the Events table. + .. Find the event to filter, click the *More actions* menu (*...*), then select *Add Endpoint event filter*. @@ -29,7 +29,7 @@ Create event filters from the Hosts page or the Event filters page. TIP: Since you can only create filters for endpoint events, be sure to filter the Events table to display events generated by the {elastic-endpoint}. + For example, in the KQL search bar, enter the following query to find endpoint network events: `event.dataset : endpoint.events.network`. -* To create an event filter from the Event filters page: +* To create an event filter from the **Event filters** page: .. Cick *Add event filter*, which opens a flyout. -- +