uberAgent

Event Data Filtering Examples

November 28, 2024

Contributed by:

Article Purpose

This article is a pool of Event Data Filtering rules and gets extended continually. Sources could be support tickets or community posts.

The rules serve as a suggestion of what is possible with Event Data Filtering and must be tested before use in your own company.

First, read the official documentation on Event Data Filtering. A few examples are listed there. Then, browse through the rules below.

List of Rules

Logons

# Do not send data about logons of the service user "LogonTest" in domain "AD" and of local as well as domain admins
# Last rule update: 2021-12-22

[EventDataFilter]
Action = deny
Sourcetype = Logon:LogonDetail
Sourcetype = Logon:GroupPolicyCSEDetail2
Query = User == "AD\\LogonTest" OR User LIKE r"%\\administrator"

[EventDataFilter]
Action = deny
Sourcetype = Process:LogonProcesses
Query = ProcUser == "AD\\LogonTest" OR ProcUser LIKE r"%\\administrator"
 

Miscellaneous

# Do not send any data about the user "JohnDoe" in domain "AD"
# You need to list every source type with one of the following fields: User, ProcUser, or SessionUser
# A list of source types is available in the metrics documentation on /en-us/uberagent/
# Last rule update: 2021-12-22

[EventDataFilter]
Action = deny
Sourcetype = Application:BrowserPerformanceChrome
Sourcetype = Application:BrowserWebRequests2
Sourcetype = Application:Errors
Sourcetype = Process:LogoffProcesses
Sourcetype = Process:LogonProcesses
Sourcetype = Process:NetworkTargetPerformance
Sourcetype = Process:ProcessDetail
Sourcetype = Process:ProcessStartup
Sourcetype = Process:ProcessStop
Sourcetype = ActivityMonitoring:ProcessTagging
Query = ProcUser == "AD\\JohnDoe"

[EventDataFilter]
Action = deny
Sourcetype = Application:NetworkConnectFailure
Sourcetype = Application:UIDelay
Sourcetype = Logoff:LogoffDetail
Sourcetype = Logon:GroupPolicyCSEDetail2
Sourcetype = Logon:LogonDetail
Sourcetype = Tags:UserHost
Query = User == "AD\\JohnDoe"

[EventDataFilter]
Action = deny
Sourcetype = Session:SessionDetail
Query = SessionUser == "AD\\JohnDoe"
 

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Event Data Filtering Examples

November 28, 2024

Contributed by:

Event Data Filtering Examples

Article Purpose

List of Rules

Logons

Miscellaneous

In this article