Monitoring - filter rules

Elevate24 collects a lot of data generated by other processes on devices while users are elevated. To reduce this noise and the amount of data reported back to a SIEM, Microsoft Sentinel, or Jigsaw24 Portal, filter rules can be configured as follows:

Filter rules

• Availability: Premium
• Type: Array

Rules to suppress specific events from being reported. Each rule can match on event type, file path, and/or signing ID — any event matching all specified criteria in a rule will be filtered out.

<key>filterRules</key>
	<array>
		<dict>
			<key>eventType</key>
			<string>All</string>
			<key>path</key>
			<string>/private/var/*</string>
			<key>signingId</key>
			<string>com.apple.softwareupdated</string>
		</dict>
		<dict>
			<key>eventType</key>
			<string>All</string>
			<key>signingId</key>
			<string>com.zscaler.tunnel</string>
		</dict>
	</array>

Parameters

Key	Type	Required	Description
eventType	String	Yes	The event type to filter. Use All to match every event type, or specify a value from the Event Types page.
path	String	No	File or directory path to match. Supports wildcards, e.g. /private/var/*
signingId	String	No	Signing ID of the process that generated the event, e.g. com.apple.softwareupdated

NOTE

At least one of path or signingId should be specified alongside eventType to avoid filtering out all events of a given type.

TIP

Filter rules are useful for suppressing high-volume system noise from trusted Apple processes or third-party security agents such as Zscaler, CrowdStrike, or similar tools.