# Normalized Event Filters

## Overview

You can use normalized event filters in Panther to filter out data after it has been classified—i.e., after it has been parsed according to a log schema.

Normalized event filters can be created as either inclusion or exclusion filters. Learn about the [difference between inclusion and exclusion filters here](https://docs.panther.com/data-onboarding/ingestion-filters/pages/g2lr2h6HsVHD2RHTfQkB#inclusion-vs.-exclusion-filters).

Once you have enabled a raw event filter, monitor its performance by [viewing filtered event metrics](#viewing-filtered-event-metrics).

{% hint style="info" %}
Normalized event filters rely on the schema of the associated log type. If you change the schema, the filter may no longer be applicable—be sure to also update related filters as needed.
{% endhint %}

{% hint style="warning" %}
If you create multiple (inclusion or exclusion) normalized event filters, there is no guarantee of the order they will run in. Because of this, if you are creating multiple `OR` expressions for inclusion, it's recommended to package them within the same filter. If you instead create multiple separate inclusion filters, events you intend to include could be dropped if another filter that is evaluated first does not include them.
{% endhint %}

## How to create a normalized event filter

To create a normalized event filter:

1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Log Sources**.
2. Click the name of the log source you'd like to add a filter to.
3. Click the **Filters** tab.
4. On the right-hand side of the **Normalized Event Filters** tile, click **Add Filter**.

   <figure><img src="/files/FigHmCF1tiZJl1MwMkPo" alt="Under a &#x22;TestSqs&#x22; header, an arrow is drawn from a Filters tab to an Add Filter button on a Normalized Events Filters tile." width="375"><figcaption></figcaption></figure>
5. A new filter form will be expanded. Configure the filter:
   1. (Optional) Click the pencil icon (<img src="/files/LCIugMd3WaBAZ4KunQGV" alt="pencil icon" data-size="line">) to edit the filter's name.
   2. In the **Log Type** dropdown, select the log type this filter should apply to.
   3. In the **Condition** dropdown, make a selection:
      * **Exclude if**: Choose this if you'd like to create an [exclusion filter](https://docs.panther.com/data-onboarding/ingestion-filters/pages/g2lr2h6HsVHD2RHTfQkB#inclusion-vs.-exclusion-filters).
      * **Include if**: Choose this if you'd like to create an [inclusion filter](https://docs.panther.com/data-onboarding/ingestion-filters/pages/g2lr2h6HsVHD2RHTfQkB#inclusion-vs.-exclusion-filters).
        * Note that in case of inclusion filters, everything *not matching* will be dropped and there will be no way of re-ingesting.
   4. Click **Add Filter**, then configure the filter:
      1. Select an event field from the dropdown. Only fields of the selected log type are shown.
      2. Select an operator from the dropdown menu.
         * The dropdown options will be limited to those applicable to the selected field's data type. See [Supported field types and operators](#supported-field-types-and-operators), below.
      3. Enter a value, if the selected operator requires one.
      4. If you would like to create another filter expression:

         * To create an `AND` filter, click outside the expression you just created (but within the same horizontal bar), or press `TAB`.
           * To create an `OR` filter, click **+ Add OR Condition**.

         <figure><img src="/files/8Z1snEg6Iny888f52A8r" alt="A &#x22;Normalized Event filters&#x22; expandable block is shown with fields including &#x22;Log Type,&#x22; &#x22;Exclusion Pattern,&#x22; and Quick Test." width="563"><figcaption></figcaption></figure>
   5. In the upper-right corner, click **Save**.

## Enabling or disabling a normalized event filter

After an ingestion filter has been created, you can enable or disable it:

1. In the left-hand navigation bar of your Panther Console, click **Configure** > **Log Sources**.
2. Click the name of the log source you'd like to enable or disable a filter on.
3. Click the **Filters** tab.
4. Locate the filter you'd like to enable or disable, and set its toggle to **Enabled** or **Disabled**.\
   ![A log source titled "Dev account" is shown. An arrow is drawn from a tab called "Filters" to an "Enabled" toggle next to a filter in the "Normalized Events filters" section.](/files/26U90f0nxlSLlihxSn6P)

## Viewing filtered event metrics

* See [Viewing filtered event volume](/data-onboarding/monitoring-log-sources.md#viewing-filtered-event-volume).

## Supported field types and operator semantics

You can configure filters on event fields with data types in the "Field data type" column. The operators listed in the "Supported operators" column are a subset of the [Search tool's supported operators](/search/search-tool/filter-operators.md#supported-operators).

<table><thead><tr><th width="205">Field data type</th><th>Supported operators</th><th width="263">Notes</th></tr></thead><tbody><tr><td><code>string</code></td><td><ul><li>is / is not</li></ul></td><td><code>null</code> values are ignored.<br><br>E.g.: If filter is <code>"animal" IS "bear"</code> , the payload <code>{"animal": null}</code> will not match.<br><br>However, the filter <code>"animal" IS NOT "bear"</code> will <strong>also not match.</strong></td></tr><tr><td></td><td><ul><li>is / is not empty (not the same as "is / is not null")</li></ul></td><td><code>null</code> values are ignored.<br><br>E.g.: If filter is <code>"animal" IS EMPTY</code> , the payload <code>{"animal": null}</code> will not match.<br><br>However, the filter <code>"animal" IS NOT EMPTY</code> will <strong>also not match.</strong></td></tr><tr><td></td><td><ul><li>is / is not in list</li></ul></td><td><p>Whitespace in filter tokens is ignored!<br></p><p>E.g.: If filter is  <code>is in list ["text "]</code> the <code>"text"</code> payload (no trailing space) will also match.<br><br>The opposite <strong>is not true!</strong> Spaces are <strong>not ignored in payload values</strong>.<br><br>E.g.: If filter is  <code>is in list ["text"]</code> the <code>"text "</code> payload (trailing space) will not match.</p></td></tr><tr><td></td><td><ul><li>has / does not have substring</li></ul></td><td><code>null</code> values in payloads will <strong>not match</strong> in both <code>has substring</code> <strong>and</strong> in <code>does not have substring</code><br><br>E.g:. Both filters <code>"animal" has substring "bear"</code> and <code>"animal" does not have substring "bear"</code> will not match with payload <code>{"animal": null}</code> </td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr><tr><td></td><td><ul><li>is within <a href="https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing">CIDR</a></li></ul></td><td></td></tr><tr><td><code>boolean</code></td><td><ul><li>is true / is false</li></ul></td><td></td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr><tr><td><code>number</code><br>(<code>int</code>, <code>bigint</code>, <code>smallint</code>, <code>float</code>)</td><td><ul><li>equals / does not equal</li></ul></td><td></td></tr><tr><td></td><td><ul><li>is greater than or equal to</li></ul></td><td></td></tr><tr><td></td><td><ul><li>is less than or equal to</li></ul></td><td></td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr><tr><td><code>timestamp</code></td><td><ul><li>is before / is after</li></ul></td><td></td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr><tr><td><code>array</code></td><td><ul><li>has / does not have</li></ul></td><td>Filtering on nested fields is supported <strong>on a substring basis!</strong><br><br>E.g.: If filter is <code>"animals" contains "wolf"</code> , the payload <code>{"animals": ["dog", "wolf"]}</code> will match, however the payload <code>{"animals": ["dog", "werewolf"]}</code> will <strong>also match</strong>.<br><br>Also, missing fields in payloads do not match with <code>does not have</code> filters.<br><br>E.g.: A filter like <code>"animals" does not have "bear"</code>, will <strong>not match</strong> a payload like <code>{"irrelevant": "something-else"}</code>.<br><br>Furthermore, all nested fields are coerced into strings.<br><br>E.g.: A filter like <code>"animals" has  "1"</code>, will <strong>match both</strong> of these payloads <code>{"animals": ["1","2"]}</code>,  <code>{"animals": [1,2]}</code>,</td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr><tr><td><code>object</code></td><td><ul><li>contains / does not contain</li></ul></td><td>Filtering on nested fields is supported <strong>on a substring basis, and both keys and values are considered!</strong><br><br>E.g.: If filter is <code>"animal" contains "werewolf"</code> , the payload <code>{"animal": {"type":  "werewolf"}}</code> will match, however the payload<code>{"animal":  {"werewolf": {"age": 3}}}</code> will <strong>also match.</strong></td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr><tr><td><code>json</code></td><td><ul><li>contains / does not contain</li></ul></td><td>Filtering on nested fields is supported with the <code>contains</code> condition. This also works <strong>on a substring basis, and both keys and values are considered!</strong><br><br>E.g.: If filter is <code>"animals" contains "wolf"</code> , the payload <code>{"animals": ["dog", "wolf"]}</code> will match, however the payload <code>{"animals": ["dog", "werewolf"]}</code> will <strong>also match</strong>.<br><br>JSON-type fields will display as <code>object</code> in the Normalized Filter UI.</td></tr><tr><td></td><td><ul><li>is / is not null</li></ul></td><td>Explicit <code>"null"</code> string is also handled and considered matching</td></tr></tbody></table>


---

# Agent Instructions: Querying This Documentation

If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://docs.panther.com/data-onboarding/ingestion-filters/normalized-event.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.