Filter Operation

Filter consists of a Boolean expression that evaluates the current event from the real-time event stream. It compares event attributes to user-specified values using a wide set of operators

The Boolean expression is a composite of comparison and match instructions.

The syntax for filter is:

Filter <Boolean expression 1> [NOT|AND|OR <Boolean expression 2] […] [NOT|AND|OR <Boolean expression n>]

Where

<Boolean expressions 1…n> are expressions using one or more event field names and filter operators

For example, this rule detects whether the current event has a severity of 4 and the resource event field contains either "FW" or "Comm."

filter(e.sev = 4 and (e.res match regex ("FW") or e.res match regex ("Comm")))