Skip to content

Manage Filters

The Manage module is where administrators control what happens to incoming audit log data after it has been processed by receivers. Audit filters define conditions that incoming events must meet and specify what actions are taken when those conditions are matched — retaining events for storage, generating alerts, tagging events for categorization, discarding unwanted noise, or forwarding data to external systems.

Understanding audit filters:

Audit filters define criteria for:

  • Which audit events to retain or discard
  • Alert conditions for security-relevant events
  • Tagging and categorization of events
  • Forwarding events to external systems

Filters are evaluated in priority order as events arrive. Once a filter matches an incoming event the configured action is applied. Multiple filters can apply to the same event depending on your configuration.

Accessing the Manage module:

  1. Log in to the LT Auditor MP web portal
  2. Navigate to Manage in the main navigation menu
  3. Select an Environment from the environment list
  4. Choose a Category card to view and manage filters for that category

Creating an audit filter:

Requires createFilter permission.

  1. Select the target environment and category
  2. Click Add Filter
  3. Configure the filter details:
Field Description
Filter Name A descriptive name clearly indicating the filter’s purpose
Description The purpose and criteria of the filter
Priority The evaluation order — filters are evaluated in priority order
Active Status Enable or disable the filter
  1. Configure filter conditions — see below
  2. Configure filter operations — see below
  3. Configure filter actions — see below
  4. Click Save

Filter conditions:

Conditions define which incoming events match the filter.

Simple conditions:

  1. In the filter editor click Add Condition
  2. Select a field from the log schema
  3. Choose an operator:
Operator Description
Equals Exact match
Contains Partial text match
Starts With / Ends With Pattern matching
Greater Than / Less Than Numeric comparison
In / Not In Match against a list of values
Is Null / Is Not Null Check for empty values
  1. Enter the comparison value
  2. Click Save Condition

Complex conditions (AND/OR logic):

  1. Click Add Condition Group
  2. Choose the logical operator:
    • AND — all conditions in the group must match
    • OR — any condition in the group must match
  3. Add multiple conditions within the group
  4. Nest condition groups for complex logic:

Example: (A OR B) AND (C OR D)

Filter operations:

Define which event types (operations) the filter applies to:

  1. Navigate to the Operations tab in the filter editor
  2. Select operations from the available list:
    • Use the checkbox tree to select individual operations
    • Select a parent category to include all child operations beneath it
  3. Save the filter

Filter actions:

Specify what happens when an incoming event matches the filter:

Action Description
Retain Store the event in the database
Alert Generate an alert notification
Tag Add metadata tags to the event for categorization
Discard Do not store the event — it is not retained
Forward Send the event to an external system

Configuring actions:

  1. In the filter editor navigate to Actions
  2. Select one or more actions to apply
  3. Configure action-specific parameters:
    • For Alert — configure recipients, severity, and notification frequency
    • For Tag — define the tag value to apply
    • For Forward — specify the external destination
  4. Save the filter

Use Discard actions carefully. An overly broad discard filter can silently drop security-relevant events. Always test discard filters thoroughly before activating them in production.

Testing filters:

Before activating a filter test it against existing log data:

  1. Open the filter configuration
  2. Click Test Filter
  3. Review the test results:
    • Number of events that would match
    • A sample of matching events
    • Performance metrics
  4. Adjust filter conditions as needed and re-test before activating

Filter templates:

Save commonly used filter configurations as templates to speed up future filter creation.

Saving a filter as a template:

  1. Create or edit a filter
  2. Click Save as Template
  3. Provide template details:
    • Template Name
    • Description
    • Category — for organization
  4. Save the template

Creating a filter from a template:

  1. Click New Filter from Template
  2. Select a template from the list
  3. Customize the filter as needed for this specific use case
  4. Save the new filter

Managing existing filters:

Editing a filter:

Requires updateFilter permission.

  1. Select the filter to edit
  2. Click the Edit icon
  3. Make the necessary changes
  4. Click Save

Enabling and disabling filters:

To temporarily suspend a filter without deleting it:

  1. Locate the filter in the list
  2. Toggle the Active switch
  3. Inactive filters are not applied to incoming events but are retained for future use

Deleting a filter:

Requires deleteFilter permission. Consider disabling a filter rather than deleting it — deleted filters cannot be recovered.

  1. Select the filter
  2. Click the Delete icon
  3. Confirm the deletion

Best practices:

  • Use descriptive filter names that clearly indicate what the filter does and why — this is especially important for Discard filters where the intent may not be obvious
  • Set priorities carefully — filters are evaluated in order and the sequence matters when multiple filters could match the same event
  • Always test filters before activating them, particularly Discard filters that could silently drop important events
  • Use filter templates for commonly applied filter patterns to ensure consistency and save setup time
  • Document the business logic behind each filter so other administrators understand the intent without needing to read the condition logic
  • Review active filters regularly to confirm they remain appropriate as your environment and compliance requirements evolve
  • Prefer disabling filters over deleting them so configurations can be recovered if needed

[Your administrator should maintain a record of all active filters, their intended purpose, and the environments and categories they apply to so the configuration is fully auditable.]