# Spectra Detect Filter Management — Advanced Egress Filtering Rules

> Build advanced inclusive or exclusive egress filters in Spectra Detect using file type, classification, YARA match, MITRE technique, and behavior conditions.

In addition to regular [file filtering on egress integrations](../ApplianceConfiguration#file-filters), you can set up an advanced filter. Advanced filters have more options and therefore allow more granularity. 

**Note: Advanced filters are currently available for [Spectra Analyze](/SpectraAnalyze/) Integration (Central Configuration > Egress Integrations > Spectra Analyze Integration), AWS S3 (Central Configuration > Egress Integrations > AWS S3 > File Storage/Unpacked Files Storage/Report Storage > Enable Filter), and Callback (Central Configuration > Egress Integrations > Callback > Enable Filter)**


### Types of filters

Filters can be either **inclusive** or **exclusive**. If a filter is inclusive, that means that all files that match you criteria will be saved to an S3 bucket. If it's exclusive, you will save everything *except* the files that match your criteria.

When creating a filter, you can also specify that it should only apply to top-level parent files: **Filter Applies Only to Container**. In this case, extracted files will not be saved.

### Conditions

Conditions allow you to specify rules based on various attributes such as file type, file size, classification, and more. 

Conditions are grouped into categories:

- **File**: filters related to one of the recognized file types and file size
- **Classification**: filters related to [how we classify files](/General/AnalysisAndClassification/Classification)
- **Identification**: filters for file format identification
- **Behavior**: filters for network calls made by a file (see the [report schema](/SpectraDetect/report-schema#uri))
- **Document**: if a file is identified as a document, these filters allow you to narrow down what you save based on the document attributes, such as number of pages or word count
- **Unpacking**: similar to how the "Identification" category of conditions relates to file format identification, this category contains filters based on file unpacking
- **File statistics**: filters operating on statistics produced by an analysis (for example, the `count` of files of a particular type found in an analyzed file)
- **Capabilities**: different capabilities detected in the analyzed file
- **YARA matches**: see description of the filters [in the report schema](/SpectraDetect/report-schema/#yara)
- **Indicators**: see [report schema](/SpectraDetect/report-schema/#indicator)
- **Mitre**: one of the Mitre [techniques](https://attack.mitre.org/techniques/enterprise/)
- **Tags**: the full list is available in the [report schema appendix](/SpectraDetect/report-schema/#appendix-c-spectra-core-tags)
