Define filters for observations and events

On the ePO - On-prem console, create or change an Application Control policy or rule group.

Select the Filters tab and expand Observations & Events.

Click Add Rule to add a filter row.

You can create filters based on files, events, programs, registry keys, and users. By default, all defined filters are applied to observations.

Edit the settings to specify the filter.

Click + or Add Rule to specify additional AND or OR conditions, respectively.

Select Apply rule to events also for a set of rules to apply the filter rules to events.

You can also define advanced exclusion filters from the Solidcore Events page.