Skip to content
Merged
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions docs/management/admin/event-filters.asciidoc
Original file line number Diff line number Diff line change
Expand Up @@ -16,20 +16,20 @@ IMPORTANT: Since an event filter blocks an event from streaming to {es}, be cons

By default, event filters are recognized globally across all hosts running {elastic-defend}. If you have a https://www.elastic.co/pricing[Platinum or Enterprise subscription], you can also assign an event filter to a specific {elastic-defend} integration policy, which would filter endpoint events from the hosts assigned to that policy.

Create event filters from the Hosts page or the Event filters page.
Create event filters from the **Hosts** page or the **Event filters** page.

. Do one of the following:
+
--
* To create an event filter from the Hosts page:
* To create an event filter from the **Hosts** page:
.. Select the *Events* tab to view the Events table.
+
.. Find the event to filter, click the *More actions* menu (*...*), then select *Add Endpoint event filter*.
+
TIP: Since you can only create filters for endpoint events, be sure to filter the Events table to display events generated by the {elastic-endpoint}. +
For example, in the KQL search bar, enter the following query to find endpoint network events: `event.dataset : endpoint.events.network`.

* To create an event filter from the Event filters page:
* To create an event filter from the **Event filters** page:
.. Cick *Add event filter*, which opens a flyout.
--
+
Expand Down