Event filter

When an information is published in Canopsis, the event filter function decides whether to keep or delete it, based on objective criteria.

These criteria are based on event attributes:

• Source
• Component / Resource
• Message
• Severity…
  
  

Event filter can also be used to enrich events and entities through several actions:

• Drop: delete an event
• Break: stop evaluation of the following rules
• Change entity: manipulate the identifier of an entity before it is registered in Canopsis (excluding personalized information).
• Enrichment: enrich or modify an event and add customized information to entities
  
  

Upcoming 2025 updates:

• Possibility of receiving notifications on event filters in the near future.
• Easily view all filtering rules applied to an alarm, thanks to enrichment traceability

For more information on the event filtering module and many other features of our Open Source hypervision solution, visit the Canopsis documentation. Any unanswered questions? You can also discuss our team directly via the contact form of our website.