Event filter

When an information is published in Canopsis, the event filter function decides whether to keep or delete it, based on objective criteria.

These criteria are based on event attributes:

• Source
• Component / Resource
• Message
• Severity…

Event filter can also be used to enrich events and entities through several actions:

• Drop: delete an event
• Break: stop evaluation of the following rules
• Change entity: manipulate the identifier of an entity before it is registered in Canopsis (excluding personalized information).
• Enrichment: enrich or modify an event and add customized information to entities

For more information on the event filter module and many other features of our open-source hypervisor solution, visit the Canopsis documentation (in French, please use your browser translator to read in other languages). Any unanswered questions? You can also contact our technical team on the contact form.