The Event Streamer module allows you to filter unwanted events and allow the collection of important events to the destination folder while ignoring the events with limited or no value.
To add a filter to the module,
Open the Event Streamer module policy configuration page.
Select the Event Filters tab.
Click the ADD FILTER button.
The Create Filter dialog box appears.
Enter the following details for creating a filter to prevent events from being processed:
Note
To simplify creation of the filter condition’s name/value pairs, you can use Windows Event Viewer’s XML View and find their names and values.
For example, to filter the Notepad process, you need to add the EventId and NewProcessName fields to the conditions of the filter. To add the condition of the EventId, set the Field Name to EventID and value to be 4688. Repeat the same steps for adding NewProcessName condition.
Filter Name: Specifies the name of the filter. This field is not used by the module. For example, Notepad process creation.
Filter Type : The event type applied to the filter.
Field Name: The field in the event data that is examined for the specified value. This is the actual condition applied for the event to be filtered.
Value: The condition met for the event to be filtered.
Click Save to save the conditions applied to the filter and the policy. When the new policy has been received by the module, the filtered event type will no longer be collected, stored or sent to any servers.
Example
Lets look at an example on how to filter the process creation events from a specific executable. Here, the notepad.exe process creation events is been filtered from being monitored and streamed.
To add a filter to the module,
Open the Event Streamer module policy configuration page.
Select the Event Filters tab to display any existing filters and add additional ones if required.
Click the ADD FILTER button.The Create Filter dialog box appears.
Enter the following details for creating a filter to prevent events from being processed:
Filter Name: Notepad process creation.
Filter Type: Event Log.
To facilitate the creation of the filter condition’s name / value pairs, use Windows Event Viewer’s XML View to find the names and values to use. To filter the Notepad process, add the EventId and NewProcessName fields to the conditions of the filter. To add the condition of the EventId, set the Field Name to be EventID and the value to be 4688. When these fields have been entered, add the NewProcessName condition to the filter.
Field Name: Event ID.
Value: 4688.
Click Save to save the policy.
When the new policy is received by the module, the notepad process creation events will no longer be collected, stored or sent to any servers.