Skip Navigation
  1. BlackBerry Docs
  2. Cylance Endpoint Security
  3. Administration
  4. Cylance Endpoint Security Administration Guide
  5. Using CylanceOPTICS to detect and respond to events
  6. Creating custom detection rules
  7. Create and manage detection rules and exclusions
  8. Filters

Filters

You can use filters to narrow or expand the scope of a state to account for a smaller or larger number of events to analyze. Event filters use the same event categories, subcategories, and types that are outlined in Data structures that CylanceOPTICS uses to identify threats.
Example 1:
 The following example limits inspected events to process start events.
"Filters": [
    {
        "Type": "Event",
        "Data": {
            "Category": "Process",
            "SubCategory": "",
            "Type": "Start"
        }
    }
]
Example 2:
 The following example inspects all types of file events (create, write, delete).
"Filters": [
    {
        "Type": "Event",
        "Data": {
            "Category": "File",
            "SubCategory": "",
            "Type": "*"
        }
    }
]