event filter
The engine filter permits to users to choose which events have to be processed by Canopsis.
The engine applies filters which are composed of a priority, an action and a rule.
- The priority designates the filter application priority order.
- The action is DROP or PASS designates respectively if an event which matches with the rule will be deleted or processed by Canopsis.
- The rule parses event field values.
Definition of such filters is possible through the view filter accessible from the filter rules menu.
The view filter permits to add/edit/duplicate/delete and define a default action for events which match with none filters.
In filter editing mode (by pushing the add button or in double clicking on a filter) a wizard with two tabs permits to define a filter properties.
The tab "options" defines name, priority and action of a filter.
The tab "rule" defines how an event is chosen by the filter in edition.
