Documentation forSecurity Event Manager

Create filters in SEM

Using the SEM Console, you can create custom filters for your event log stream to complement existing SEM filters. On the Add New Filter page, create filters by dragging and dropping default filter fields to the right side of the page, and set up values and conditions using this fields, to build a filter that determines which events are monitored.

  1. On the SEM Console, click the Live Events tab.
  2. To create a filter within a group, move the mouse pointer over the group heading to expose the vertical ellipsis icon .

  3. Click on the vertical ellipsis icon , and select Add New Filter.

    To create a filter outside of the groups, click the add icon at the very top of the column, and select Add New Filter.

  4. Enter a descriptive name for your new filter.

    To establish notifications for the new filter, you can create a rule based on your filter with one click.

  5. There are several ways to add filter fields to a filter, but the drag and drop method is easiest:
    1. Expand Events or Event Groups in the left column to display filter entities.

    2. Some filter entities, such as those in the Events group, can be expanded to show filter fields.

    3. Drag an entity or field to the panel on the right.

      When you drag a filter field into the filter builder, the place to drop it is illuminated with a blue line.

    4. Move the cursor over the condition you have just created.

    5. The current condition is displayed. Use the drop-downs to change this to your required condition. For example, in this case the only meaningful change you can make is from "Access.IsThreat is equal to True" to "Access.IsThreat is equal to False", but other conditions can involve strings, numerical values, or group values (see below for using group values). For information on using operators (such as "is equal to", "is in", etc) see Compare values with operators in SEM.

    6. Click save when you have set up the condition how you want it.
  6. A filter can consist of one or more conditions. To add further conditions, drag the required field to just beneath the previous condition. As before a blue line shows where to drop it.

    Initially, multiple conditions are assumed to be additive, and the AND operator is displayed.

  7. To change the operator, click AND, and then select OR.

    If you create a multiple condition that combines conditions with AND and OR operators, you will need to group the conditions accordingly. For example, the following condition flags an error as the condition is ambiguous.

    To show that you want this filter to display events where the access severity does not matter but detection time is during business hours or events where the detection time is during the late shift and the severity is not less than 5, you need to group as follows.

  8. Click on AND, and select Group.

    The condition is redisplayed.

  9. Click Save to save the filter. It is now be available in the column on the left.