QUESTION

The Inline Filter on my detection isn't filtering events out as expected. How do I troubleshoot this?

ANSWER

To troubleshoot an Inline Filter:

  1. Ensure the syntax of the filter is correct.

  2. Confirm the filtered field is available in the event.

    Keep in mind that panther_rule_matches fields are generated after the events pass through the detection. Since Inline Filters run before detections, these fields won't be available for filtering.

  3. Add a unit test with an event that tests the filter's logic, to ensure that the individual filter is working.

  4. If multiple filters are included, check the AND/OR logic.

    • It may be helpful to reference De Morgan's Law to ensure that any negations are correct.

If the filter is still not working, please contact Panther Support and provide the following information:

  1. A zip file of the detection

  2. A sample event that you are expecting to filter out