event-filter tapsender filter-name ＜eventType＞ match ＜fieldName＞ equals ＜fieldValue＞

Configures a rule to filter out events that are sent from a Network Security appliance to Helix based on a combination of event type, field name, and field value. This command filters out events with a field value that equals the specified value.

For more information on configuring event filter rules, see the Network Security User Guide.

The following table lists the event types and some of the associated filter fields:

Event Type	Description	Filter Field Examples
`http`	HTTP events	`http.hostname` `http.url` `http.http_user_agent`
`smtp`	SMTP events	`smtp.mail_from` `email.status`
`dnp3`	DNP3 events	`dnp3.type` `dnp3.control.dir` `dnp3.control.pri` `dnp3.control.fcb` `dnp3.control.fcv` `dnp3.control.function_code` `dnp3.src` `dnp3.dst` `dnp3.application.control.fir` `dnp3.application.control.fin` `dnp3.application.control.con` `dnp3.application.control.uns` `dnp3.application.control.sequence` `dnp3.application.function_code` `dnp3.application.complete`
`dns`	DNS events	`dns.rrname` `dns.rrtype` `dns.rdata`
`dcerpc`	Distributed Computing Environment Remote Procedure Call (DCE-RPC) events	`dcerpc.interface.uuid` `dcerpc.interface.version` `dcerpc.interface.minor-version` `dcerpc.user` `dcerpc.domain` `dcerpc.host`
`fileinfo`	File information events	`fileinfo.filename` `fileinfo.md5` `fileinfo.stored`
`flow`	Flow events	`app_proto` `flow.pkts_toserver` `flow.pkts_toclient`
`imap`	Internet Message Access Protocol (IMAP) events	`email.status` `email.from`
`pop3`	POP3 (Post Office Protocol) events	`email.status` `email.from`
`irc`	Internet Relay Chat (IRC) events	`irc.user` `irc.prefix` `irc.cmd`
`modbus`	Modbus events	`modbus.transaction_id` `modbus.protocol_id` `modbus.unit_id` `modbus.function_code` `modbus.function_category` `modbus.exception_code` `modbus.diag_subfunction` `modbus.mei` `modbus.response` `modbus.read.address` `modbus.read.quantity` `modbus.write.address` `modbus.write.quantity` `modbus.write.count`
`rdp`	Remote Desktop Protocol (RDP) events	`rdp.type` `rdp.t125_connect.version_major` `rdp.t125_connect.version_minor`
`rtsp`	Real Time Streaming Protocol (RTSP) events	`rtsp.request.type` `rtsp.request.accept` `rtsp.response.content_type`
`smb`	Server Message Block (SMB) events	`smb.command` `smb.command_str` `smb.status` `smb.session_setup.request.host`
`smb2`	SMB2 events	`smb2.status` `smb2.session_setup.type` `smb2.session_setup.authenticate.domain`
`ssh`	Secure Shell (SSH) events	`ssh.client.proto_version` `ssh.client.software_version` `ssh.server.proto_version`
`ftp`	File Transfer Protocol (FTP) events	`ftp.user` `ftp.pass` `ftp.port`
`tls`	TLS events	`tls.subject` `tls.version` `tls.notbefore`
`mysql`	MySQL events	`mysql.command` `mysql.arguments` `mysql.success` `mysql.rows_affected` `mysql.response_error`
`krb5`	Kerberos (KRB5) events	`krb5.request_type` `krb5.client` `krb5.client_realm` `krb5.server` `krb5.server_realm` `krb5.from` `krb5.till` `krb5.cipher` `krb5.forwardable` `krb5.renewable` `krb5.success` `krb5.error_code`
`socks`	SOCKS events	`socks.ver4.request.command` `socks.ver4.request.remote_port` `socks.ver4.request.remote_address` `socks.ver4.request.username` `socks.ver4.request.remote_V4A_domain_name` `socks.ver4.response.result` `socks.ver4.response.port` `socks.ver4.response.address` `socks.ver5.request.method_count` `socks.ver5.request.method_0` `socks.ver5.request.method_1` `socks.ver5.request.method_2` `socks.ver5.request.method_3` `socks.ver5.request.method_4` `socks.ver5.request.method_5` `socks.ver5.request.method_mismatch` `socks.ver5.request.username_length` `socks.ver5.request.username` `socks.ver5.request.password_length` `socks.ver5.request.password` `socks.ver5.request.command` `socks.ver5.request.address_type` `socks.ver5.request.remote_address` `socks.ver5.request.remote_port` `socks.ver5.request.remote_name` `socks.ver5.request.remote_name_length_field` `socks.ver5.request.remote_name_length` `socks.ver5.response.accepted_method` `socks.ver5.response.unexpected_method` `socks.ver5.response.status` `socks.ver5.response.result` `socks.ver5.response.address_type` `socks.ver5.response.remote_name_length` `socks.ver5.response.remote_address` `socks.ver5.response.remote_port`
`all`	All event types	None

Note
Helix integration is not supported on the NX x3xx appliances and the NX 10000 appliance.

Important
Make sure the Evidence Collector module is enabled before you add or delete event filter rules. Use the show tapsender status command.

Important
Your event filter configuration changes will not take effect until you apply the changes. The status pending or mark_deleted appears in the show event-filter tapsender configuration <eventType> command output if you did not apply the changes.

Syntax

[no] event-filter tapsender filter-name <eventType> match <fieldName> equals <fieldValue>

Parameters

no
Deletes the filter rule.
<eventType>no
The event type.
match
Filters out the events that match the filter rule.
<fieldName>
The event field name.
<fieldValue>
The event field value.

Example

The following example filters out the DNS event matches for the dns.rdata field that equals the a28-129.akadns.org value:

hostname (config) # event-filter tapsender filter-name dns match dns.rdata equals a28-129.akadns.org
hostname (config) # event-filter tapsender config apply

User role

Admin or Operator

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Network Security: Release 8.1. The command was enhanced to include dcerpc event filters for user, domain, and host in Release 8.3.0.