event-filter tapsender filter-name ＜eventType＞ match ＜src_ip/dest

Configures a rule to filter out events that are sent from a Network Security appliance to Helix based on a combination of event type, source or destination IP address, and field value using Classless Inter-Domain Routing (CIDR) based event filtering.

For more information on configuring event filter rules, see the Network Security User Guide.

The following table lists the event types and some of the associated filter fields:

Event Type	Description	Filter Field Examples
`http`	HTTP events	`http.hostname` `http.url` `http.http_user_agent`
`smtp`	SMTP events	`smtp.mail_from` `email.status`
`dnp3`	DNP3 events	`dnp3.type` `dnp3.control.dir` `dnp3.control.pri` `dnp3.control.fcb` `dnp3.control.fcv` `dnp3.control.function_code` `dnp3.src` `dnp3.dst` `dnp3.application.control.fir` `dnp3.application.control.fin` `dnp3.application.control.con` `dnp3.application.control.uns` `dnp3.application.control.sequence` `dnp3.application.function_code` `dnp3.application.complete`
`dns`	DNS events	`dns.rrname` `dns.rrtype` `dns.rdata`
`dcerpc`	Distributed Computing Environment Remote Procedure Call (DCE-RPC) events	`dcerpc.interface.uuid` `dcerpc.interface.version` `dcerpc.interface.minor-version` `dcerpc.user` `dcerpc.domain` `dcerpc.host`
`fileinfo`	File information events	`fileinfo.filename` `fileinfo.md5` `fileinfo.stored`
`flow`	Flow events	`app_proto` `flow.pkts_toserver` `flow.pkts_toclient`
`imap`	Internet Message Access Protocol (IMAP) events	`email.status` `email.from`
`pop3`	POP3 (Post Office Protocol) events	`email.status` `email.from`
`irc`	Internet Relay Chat (IRC) events	`irc.user` `irc.prefix` `irc.cmd`
`modbus`	Modbus events	`modbus.transaction_id` `modbus.protocol_id` `modbus.unit_id` `modbus.function_code` `modbus.function_category` `modbus.exception_code` `modbus.diag_subfunction` `modbus.mei` `modbus.response` `modbus.read.address` `modbus.read.quantity` `modbus.write.address` `modbus.write.quantity` `modbus.write.count`
`rdp`	Remote Desktop Protocol (RDP) events	`rdp.type` `rdp.t125_connect.version_major` `rdp.t125_connect.version_minor`
`rtsp`	Real Time Streaming Protocol (RTSP) events	`rtsp.request.type` `rtsp.request.accept` `rtsp.response.content_type`
`smb`	Server Message Block (SMB) events	`smb.command` `smb.command_str` `smb.status` `smb.session_setup.request.host`
`smb2`	SMB2 events	`smb2.status` `smb2.session_setup.type` `smb2.session_setup.authenticate.domain`
`ssh`	Secure Shell (SSH) events	`ssh.client.proto_version` `ssh.client.software_version` `ssh.server.proto_version`
`ftp`	File Transfer Protocol (FTP) events	`ftp.user` `ftp.pass` `ftp.port`
`tls`	TLS events	`tls.subject` `tls.version` `tls.notbefore`
`mysql`	MySQL events	`mysql.command` `mysql.arguments` `mysql.success` `mysql.rows_affected` `mysql.response_error`
`krb5`	Kerberos (KRB5) events	`krb5.request_type` `krb5.client` `krb5.client_realm` `krb5.server` `krb5.server_realm` `krb5.from` `krb5.till` `krb5.cipher` `krb5.forwardable` `krb5.renewable` `krb5.success` `krb5.error_code`
`socks`	SOCKS events	`socks.ver4.request.command` `socks.ver4.request.remote_port` `socks.ver4.request.remote_address` `socks.ver4.request.username` `socks.ver4.request.remote_V4A_domain_name` `socks.ver4.response.result` `socks.ver4.response.port` `socks.ver4.response.address` `socks.ver5.request.method_count` `socks.ver5.request.method_0` `socks.ver5.request.method_1` `socks.ver5.request.method_2` `socks.ver5.request.method_3` `socks.ver5.request.method_4` `socks.ver5.request.method_5` `socks.ver5.request.method_mismatch` `socks.ver5.request.username_length` `socks.ver5.request.username` `socks.ver5.request.password_length` `socks.ver5.request.password` `socks.ver5.request.command` `socks.ver5.request.address_type` `socks.ver5.request.remote_address` `socks.ver5.request.remote_port` `socks.ver5.request.remote_name` `socks.ver5.request.remote_name_length_field` `socks.ver5.request.remote_name_length` `socks.ver5.response.accepted_method` `socks.ver5.response.unexpected_method` `socks.ver5.response.status` `socks.ver5.response.result` `socks.ver5.response.address_type` `socks.ver5.response.remote_name_length` `socks.ver5.response.remote_address` `socks.ver5.response.remote_port`
`all`	All event types	None

Note
Helix integration is not supported on the NX x3xx appliances and the NX 10000 appliance.

Important
The cidr keyword is displayed for all field options, but can be applied only with the src_ip or dest_ip field. Only IPv4 is supported.

Important
Make sure the Evidence Collector module is enabled before you add or delete event filter rules. Use the show tapsender status command.

Important
Your event filter configuration changes will not take effect until you apply the changes. The status pending or mark_deleted appears in the show event-filter tapsender configuration <eventType> command output if you did not apply the changes.

Syntax

[no] event-filter tapsender filter-name <eventType> match <src_ip/dest_ip> cidr <fieldValue>

Parameters

no

Deletes the filter rule.

<eventType>

The event type.

match

Filters out the events that match the filter rule.

<src_ip/dest_ip>

Specify the type of IP address (source or destination) associated with the event type for the filter action.

<fieldValue>

The event field value.

Example

The following example configures event filtering for DNS events that match the defined source IP mask.:

hostname (config) # event-filter tapsender filter-name dns match src_ip cidr 23.1.1.2/32
hostname (config) # event-filter tapsender config apply

User role

Admin or Operator

Command mode

Config

Supported appliances

This command is supported on the following appliances running the specified releases or later:

Network Security: Release 8.1.2. The command was enhanced to include dcerpc event filters for user, domain, and host in Release 8.3.0.