Global Filters

GET /v1/filters
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: xxx
[
  {
    "id": "2011111590957770404",
    "name": "Filter file formats",
    "description": "Filter to exclude .dll and .exe files from the scan",
    "apply_to": "16145931871908943813",
    "type": "exclude_suffix",
    "expression": ".dll, .exe"
  },
  {
    "id": "2011111590957770405",
    "apply_to": "16145931871908944000",
    "type": "include_date_range",
    "from_date": "2018-03-01",
    "to_date": "2018-04-30"
  },
  {
    "id": "2011111590957770406",
    "type": "include_recent",
    "days": 30
  }
  {
    "id": "2011111590957770407",
    "apply_to": "16145931871908943020",
    "name": "Exclude locations in var directory",
    "description": "Exclude all locations in the "/var" directory during scans",
    "enabled": "true",
    "timestamp": "1718779693",
    "type": "exclude_expression",
    "expressions": "C:\V???"
  }
]

PUT /v1/filters/2011111590957770404
Content-Type: application/json
[
  {
    "apply_to": "16145931871908943813",
    "type": "exclude_suffix",
    "expression": ".dll | .exe"
    }
]

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json
Content-Length: xxx
{
  "message": "Invalid input for '{fieldname}'."
}  

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json
Content-Length: xxx
{
  "message": "Filter name must be 80 characters or less."
}

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json
Content-Length: xxx
{
  "message": "Filter description must be 400 characters or less."
}

DELETE /v1/filters/2011111590957770404

POST /v1/filters
Content-Type: application/json
[
  {
    "apply_to": "16145931871908943813",
    "type": "exclude_suffix",
    "expression": ".dll | .exe"
    }
]

HTTP/1.1 201 Created
Content-Type: application/json
Content-Length: xxx
{
  "id": "12345678901234567890"
}  

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json
Content-Length: xxx
{
  "message": "Filter name must be 80 characters or less."
}

HTTP/1.1 422 Unprocessable Entity
Content-Type: application/json
Content-Length: xxx
{
  "message": "Filter description must be 400 characters or less."
}

POST /v1/filters/5127911297873299453/enable
Accept: application/json

POST /v1/filters/5127911297873299453/disable
Accept: application/json

GET /v1/filters/templates
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: xxx

"version": "1.0",
"filter_templates":
[
  {
    "name": "Windows Folders Exclusions",
    "description": "Focuses on user data by filtering out Windows system
    directories like System32, servicing, and Windows Defender, enhancing scan
    efficiency and relevance.",
    "type": "exclude_prefix",
    "expression": [
       "C:\\Windows\\Logs\\CBS\\",
       "C:\\Windows\\System32\\catroot\\",
       "C:\\Windows\\System32\\catroot2\\",
       "C:\\Windows\\System32\\config\\",
       "C:\\Windows\\servicing\\",
       "C:\\Windows\\debug\\",
       "C:\\Windows\\WinSxS\\",
       "C:\\Windows\\Panther\\"
       ]
  },
  {
    "name": "Linux Core Directories Filter",
    "description": "Optimizes scanning of RedHat and Oracle Linux systems by
    excluding directories that commonly contain false positives, focusing
    efforts on user-generated content and significantly reducing false positive
    rates.",
    "type": "exclude_prefix",
    "expression": [
       "/var/log/audit",
       "/var/lib/rpm",
       "/var/lib/yum",
       "/var/cache/yum",
       "/usr/share/hwdata",
       "/usr/share/doc"
       ]
  }
]