Filter consists of a Boolean expression that evaluates the current event from the real-time event stream. It compares event attributes to user-specified values using a wide set of operators
The Boolean expression is a composite of comparison and match instructions.
The syntax for filter is:
Filter <Boolean expression 1> [NOT|AND|OR <Boolean expression 2] [ ] [NOT|AND|OR <Boolean expression n>]
Where
<Boolean expressions 1 n> are expressions using one or more event field names and filter operators
For example, this rule detects whether the current event has a severity of 4 and the resource event field contains either "FW" or "Comm."
filter(e.sev = 4 and (e.res match regex ("FW") or e.res match regex ("Comm")))