Event filter

When an event is published in Canopsis, the event filter function decides whether to keep or delete it, based on objective criteria.

These criteria are based on event attributes:

• Source
• Component / Resource
• Message
• Severity…

Event filtering can also be used to enrich events and entities through several actions:

• Drop: delete an event
• Break: stop evaluation of the following rules
• Change entity: manipulate the identifier of an entity before it is registered in Canopsis (excluding personalized information).
• Enrichment: enrich or modify an event and add customized information to entities

Upcoming 2025 updates:

• Possibility of receiving notifications on event filters in the near future.
• Easily view all event filter rules applied to an alarm, thanks to enrichment traceability

For more information on the event filter module and many other features of our open-source hypervision solution, visit the Canopsis documentation. Any unanswered questions? You can also contact our technical team via the contact form.