Filter Matcher
The Filter Matcher Workflow Integration (Workflow Integration tile) allows an event, alert, or Situation to be evaluated against a defined set of CEvent filters. When a match is found, a specified value can be written to a field in the alert or Situation. For example, if an alert matches the filter severity == 5 AND description MATCHES "BGP", the integration can set custom_info.isCriticalBGP to true.
 |
When to Use the Filter Matcher
Although this use case can be achieved using existing workflow actions, the Filter Matcher enables multiple filters to be evaluated within a single workflow. This simplifies administration and can improve workflow performance.
This integration is not intended to replace existing workflow actions, and there is no requirement to modify existing workflows. Instead, it should be used when multiple filters need to be evaluated iteratively.
Filters can be organized into logical groups (for example, Network or Application). Groups are evaluated in a configurable order, and the matchFilter action can be used to evaluate specific groups only. For example, you may evaluate only the Network group for alerts originating from a particular manager or agent.
Before You Begin
Before configuring the Filter Matcher integration, ensure you have identified the following:
The destination field (event, alert, or Situation) to update.
The value to set when a match is found.
An optional default value to apply when no match is found.
The set of filters to evaluate.
Filters must be valid CEvent filter expressions and use the appropriate syntax for equality operators, quoting, and other supported constructs.
Whether matching should use first match or last match behavior.
First match: Evaluation stops within the filter group after the first matching filter is found.
Last match: All filters in the group are evaluated, and the value from the last matching filter is used.
Whether subsequent filter groups should continue to be evaluated after a match is found.
First Match vs. Last Match
A filter group can be configured to use either first match or last match behavior.
With first match, the first filter that evaluates to true (using the moogfb.evaluateFilter() API) is used to set the destination field. No further filters in that group are evaluated.
With last match, all filters in the group are evaluated, and the value associated with the final matching filter is applied.
In most cases, first match is recommended because it avoids unnecessary processing. Last match can be useful when filter conditions become progressively more specific, or when a base value is defined and later filters are intended to override it.