event-filter tapsender filter-name ＜eventType＞ drop

Configures a rule to filter out all events that are sent from an Network Security appliance to Helix for a specified event type or for all event types.

For more information on configuring event filter rules, see the Network Security User Guide.

The following table lists the event types that can be specified and some of the associated filter fields.

Note
Filter fields are not specified in this command, as all fields for the event type are dropped.

Event Type	Description	Filter Field Examples
`http`	HTTP events	`http.hostname` `http.url` `http.http_user_agent`
`smtp`	SMTP events	`smtp.mail_from` `email.status`
`dnp3`	DNP3 events	`dnp3.type` `dnp3.control.dir` `dnp3.control.pri` `dnp3.control.fcb` `dnp3.control.fcv` `dnp3.control.function_code` `dnp3.src` `dnp3.dst` `dnp3.application.control.fir` `dnp3.application.control.fin` `dnp3.application.control.con` `dnp3.application.control.uns` `dnp3.application.control.sequence` `dnp3.application.function_code` `dnp3.application.complete`
`dns`	DNS events	`dns.rrname` `dns.rrtype` `dns.rdata`
`dcerpc`	Distributed Computing Environment Remote Procedure Call (DCE-RPC) events	`dcerpc.interface.uuid` `dcerpc.interface.version` `dcerpc.interface.minor-version` `dcerpc.user` `dcerpc.domain` `dcerpc.host`
`fileinfo`	File information events	`fileinfo.filename` `fileinfo.md5` `fileinfo.stored`
`flow`	Flow events	`app_proto` `flow.pkts_toserver` `flow.pkts_toclient`
`imap`	Internet Message Access Protocol (IMAP) events	`email.status` `email.from`
`pop3`	POP3 (Post Office Protocol) events	`email.status` `email.from`
`irc`	Internet Relay Chat (IRC) events	`irc.user` `irc.prefix` `irc.cmd`
`modbus`	Modbus events	`modbus.transaction_id` `modbus.protocol_id` `modbus.unit_id` `modbus.function_code` `modbus.function_category` `modbus.exception_code` `modbus.diag_subfunction` `modbus.mei` `modbus.response` `modbus.read.address` `modbus.read.quantity` `modbus.write.address` `modbus.write.quantity` `modbus.write.count`
`rdp`	Remote Desktop Protocol (RDP) events	`rdp.type` `rdp.t125_connect.version_major` `rdp.t125_connect.version_minor`
`rtsp`	Real Time Streaming Protocol (RTSP) events	`rtsp.request.type` `rtsp.request.accept` `rtsp.response.content_type`
`smb`	Server Message Block (SMB) events	`smb.command` `smb.command_str` `smb.status` `smb.session_setup.request.host`
`smb2`	SMB2 events	`smb2.status` `smb2.session_setup.type` `smb2.session_setup.authenticate.domain`
`ssh`	Secure Shell (SSH) events	`ssh.client.proto_version` `ssh.client.software_version` `ssh.server.proto_version`
`ftp`	File Transfer Protocol (FTP) events	`ftp.user` `ftp.pass` `ftp.port`
`tls`	TLS events	`tls.subject` `tls.version` `tls.notbefore`
`mysql`	MySQL events	`mysql.command` `mysql.arguments` `mysql.success` `mysql.rows_affected` `mysql.response_error`
`krb5`	Kerberos (KRB5) events	`krb5.request_type` `krb5.client` `krb5.client_realm` `krb5.server` `krb5.server_realm` `krb5.from` `krb5.till` `krb5.cipher` `krb5.forwardable` `krb5.renewable` `krb5.success` `krb5.error_code`
`socks`	SOCKS events	`socks.ver4.request.command` `socks.ver4.request.remote_port` `socks.ver4.request.remote_address` `socks.ver4.request.username` `socks.ver4.request.remote_V4A_domain_name` `socks.ver4.response.result` `socks.ver4.response.port` `socks.ver4.response.address` `socks.ver5.request.method_count` `socks.ver5.request.method_0` `socks.ver5.request.method_1` `socks.ver5.request.method_2` `socks.ver5.request.method_3` `socks.ver5.request.method_4` `socks.ver5.request.method_5` `socks.ver5.request.method_mismatch` `socks.ver5.request.username_length` `socks.ver5.request.username` `socks.ver5.request.password_length` `socks.ver5.request.password` `socks.ver5.request.command` `socks.ver5.request.address_type` `socks.ver5.request.remote_address` `socks.ver5.request.remote_port` `socks.ver5.request.remote_name` `socks.ver5.request.remote_name_length_field` `socks.ver5.request.remote_name_length` `socks.ver5.response.accepted_method` `socks.ver5.response.unexpected_method` `socks.ver5.response.status` `socks.ver5.response.result` `socks.ver5.response.address_type` `socks.ver5.response.remote_name_length` `socks.ver5.response.remote_address` `socks.ver5.response.remote_port`
`all`	All event types	None

Note
Helix integration is not supported on the NX x3xx appliances and the NX 10000 appliance.

Important
Make sure the Evidence Collector module is enabled before you add or delete event filter rules. Use the show tapsender status command.

Important
Your event filter configuration changes will not take effect until you apply the changes. The status pending or mark_deleted appears in the show event-filter tapsender configuration <eventType> command output if you did not apply the changes.

Syntax

[no] event-filter tapsender filter-name <eventType> drop

Parameters

no

Deletes the filter rule.

<eventType>

The event type.

drop

Filters out events that match the specified event type.

Examples

The following example sets a rule to filter out all DNS events:

hostname (config) # event-filter tapsender filter-name dns drop
hostname (config) # event-filter tapsender config apply

The following example sets a rule to filter out all events for all event types:

hostname (config) # event-filter tapsender filter-name all drop

This form of the command is automatically applied and does not require the event-filter tapsender config apply command.

The following example removes the rule for filtering out all DNS events:

hostname (config) # no event-filter tapsender filter-name dns drop
hostname (config) # event-filter tapsender config apply

The following example removes the rule for filtering out all event types:

hostname (config) # no event-filter tapsender filter-name all drop

This form of the command is automatically applied and does not require the event-filter tapsender config apply command.

User role

Admin or Operator

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Network Security: Release 8.1.2