IMPORTANT: No additional bug fixes or documentation updates will be released for this version. For the latest information, see the current release documentation.
« Trusted applications Elastic Security APIs »
Elastic Docs ›Elastic Security Solution [7.14] ›Manage

Event filters

edit

Event filters

edit

Event filters allow admins to filter endpoint events that you do not need or want stored in Elasticsearch — for example, those with high volumes. By creating event filters, you can optimize your storage in Elasticsearch. All endpoint events have the endpoint.events.network field.

Create event filters from the Event filters page or the Hosts page.

Since an event filter blocks an event from streaming to Elasticsearch, be conscious of event filter conditions you set and any existing rule conditions. If there is too much overlap, the rule may run less frequently than specified and, therefore, will not trigger the corresponding alert for that rule. This is the expected behavior of event filters.

  1. To create an event filter via the Hosts page:

    1. Go to Explore → Hosts.
    2. Select the Events tab to view the Events table.

    3. Find the event to create a filter, click the More Actions button (…​), then click Add Endpoint event filter.

      Since you can only create filters for endpoint events, be sure to filter the Events table to display events generated by the Elastic Endpoint.
      In the KQL search bar, enter the following query: event.dataset : endpoint.events.network.

    4. Proceed to step 3.

  2. To create an event filter via the Event filters page:

    1. Go to Manage → Event filters.

    2. Click Add Event Filter. The Add event filter flyout opens.

      event filter
  3. Enter a name for the event filter.
  4. Depending on which page you add the filter, either modify the pre-populated conditions or add new conditions that define when Elastic Security filters events. You can define multiple conditions with AND relationships. You can also add nested conditions. In the image above, the event filter excludes events whose event.category field is network, and whose process.executable field is the same as the specified path.
  5. Add a new comment that describes or identifies the filter (optional).
  6. Click Add Endpoint Event Filter. The new filter is added to the Event filters table.

View and manage event filters

edit

The Event filters table allows you to view and manage all endpoint event filters that have been added. To view the Event filters table, go to Manage → Event filters. Event filters appear in reverse chronological order, with the most recently modified filter at the top. Each filter has its own "card," which displays details such as the filter name, operating system, date created, and the filter conditions.

event filters list

To refine the Event filters table by a specific value, enter a query in the search bar. You can search the following attributes:

  • name
  • comments
  • value

To edit an event filter:

  1. Click Edit on the appropriate event filter card.
  2. Modify details or conditions as appropriate.
  3. Click Update event filter. The newly modified filter appears at the top.

To delete an event filter:

  1. Click Remove on the event filter to delete.
  2. On the dialog that appears, confirm that you are removing the correct event filter, then click Remove event filter. A message appears confirming the filter was removed.
« Trusted applications Elastic Security APIs »