Define order for ASP and filter rules

Set the order to run filter or Advanced Syslog Parser (AsP) rules so they generate the data you need.

Verify that you have policy administration privileges.

On the Trellix ESM console, click the Policy Editor icon .
On the Operations menu, select Order ASP Rules or Order Filter Rules, then select a data source in the Data source type field.
Rules available to put into order appear on the left; ordered rules appear on the right.
On the Standard Rules or Custom Rules tab, move a rule from the left to the right (drag and drop or use the arrows), placing them above or below Unordered Rules.
Note
Unordered Rules represent the rules in the left, which are those that are in default order.
Use the arrows to reorder the rules, then click OK to save the changes.