Skip to main content
Version: Spectra Detect 7.0.0

Spectra Detect Filter Management — Advanced Egress Filtering Rules

note

On Kubernetes microservices deployments, the configuration mode, global.appliance.configMode, determines how Workers get advanced filters. In STANDARD mode, they get them from SDM. In CONFIGMAP mode, the default, define the filters in the Worker Helm chart's advancedFilters value. Select one for each integration with advancedFilterEnabled and advancedFilterName, and for the classification override with reportOverride.filterName. For more information, see the Worker configuration reference.

In addition to regular file filtering on egress integrations, you can set up an advanced filter. Advanced filters have more options and therefore allow more granularity.

note

You can use advanced filters in the following places:

  • Central Configuration > Egress Integrations > Spectra Analyze Integration: Enable Global Filter and Filter Name select the files uploaded to Spectra Analyze.
  • Central Configuration > Egress Integrations > AWS S3, on the File Storage, Unpacked Files Storage, and Report Storage tabs: Enable Global Filter and Filter Name select the files the tab stores.
  • Central Configuration > Egress Integrations > AWS S3, on the File Storage and Report Storage tabs: if Output Bucket Destination is Map to Input Bucket, each mapping you add under Output to Input Bucket Mapping can have its own filter, Mapping Filter Name. Enabling the global filter turns off mapping filters.
  • Central Configuration > Egress Integrations > Callback: Enable Filter.
  • Central Configuration > Worker Configuration > Analysis Report > Report Classification Override: Filter Name selects the files whose classification is overridden. Filters that drop files can't be used for the override.

Types of filters​

Filters can be either inclusive (Pass Files) or exclusive (Drop Files). If a filter is inclusive, that means that all files that match your criteria will be saved to external storage. If it's exclusive, you will save everything except the files that match your criteria.

When creating a filter, you can also specify that it should only apply to top-level parent files: Filter Applies Only to Container. In this case, extracted files will not be saved.

Conditions​

Conditions allow you to specify rules based on various attributes such as file type, file size, classification, and more.

Conditions are grouped into categories:

  • File: filters related to file names, file paths, recognized file types, and file size. For a file extracted from an archive, Path is its path inside the innermost archive that contains it. For the top-level file, it's only the file name.
  • Classification: filters related to how we classify files. For example, the Propagated filter indicates whether a file's malicious classification is its own (Non Propagated) or inherited from a child file (Propagated), allowing you to save only the actual malicious source files, excluding parent containers (like .zip or .tar archives) that are flagged only because they contain a malicious child.
  • Identification: filters for file format identification
  • Behavior: filters for network calls made by a file (see the report schema)
  • Document: if a file is identified as a document, these filters allow you to narrow down what you save based on the document attributes, such as number of pages or word count
  • Unpacking: similar to how the "Identification" category of conditions relates to file format identification, this category contains filters based on file unpacking
  • File statistics: filters operating on statistics produced by an analysis (for example, the count of files of a particular type found in an analyzed file)
  • Capabilities: different capabilities detected in the analyzed file
  • YARA matches: see description of the filters in the report schema
  • Indicators: see report schema
  • Mitre: one of the Mitre techniques
  • Tags: the full list is available in the report schema appendix

Matching text​

Text conditions, such as Name and Path in the File group, compare values with the Equals, Contains, Starts With, Ends With, or Matches Pattern operator.

Matches Pattern compares the whole value with a pattern and is case-insensitive:

  • * matches any text, including / in a path
  • ? matches exactly one character
  • \ makes the next character literal, for example \* for a literal asterisk

Other characters, including brackets and braces, match only themselves. For example, MyApp-*/bin/*.dll matches MyApp-8.6/bin/core.dll.