Filter Conditions#
Filter conditions specify when a rule should run. If the filter condition evaluates to true, the actions in that rule are executed.
In practice, filters let you decide which Windows events should be forwarded, which should be routed differently, and which should be ignored.
How to use them well#
Start with broad filters so the event path is easy to verify.
Narrow down with event source, event ID, severity, or log name.
Add message-content filters only after the basic event path works.
Remember that rule order matters just as much as the filters themselves.