Use the commands in this topic to reset event filter rules to the default filter values. You can reset all (reset) or reset all except those that have custom rules set (append).
Prerequisites
Administrator or Operator access to the Network Security appliance
A connection to the Dynamic Threat Intelligence (DTI) Cloud
An active subscription to Helix
Verify that you have specified a valid hostname for the VPC within an AWS endpoint. See Configuring the VPC within an AWS endpoint using the CLI .
To reset the event filter rules:
Go to CLI configuration mode:
hostname > enable hostname # configure terminal
To reset event filter rules to the default filter values but retain the custom filters:
hostname (config) # event-filter tapsender config default append
To reset all event filter rules to the default filter values:
hostname (config) # event-filter tapsender config default reset
Verify that the default event filter rules are set.
hostname (config) # show event-filter tapsender configuration default
Event Filter Configuration Default filter version : 1 status type pending_op filter name field op_type index value -------------------------------------------------------------------------------------------------------- active default flow app_proto equals 0 dns active default dns dns.rrtype equals 0 SRV active default dns dns.rrname contains 1 .in-addr.arpa active default dns dns.rrname contains 2 outlook.office365.com active default dns dns.rrname contains 3 .live.com active default dns dns.rrname contains 4 ctldl.windowsupdate.com active default dns dns.rrname contains 5 crl.microsoft.com active default dns dns.rrname contains 6 wpad active default fileinfo fileinfo.filename regex 0 ^(?i).*\Q\policies\\E.*$ active default fileinfo fileinfo.filename regex 1 ^(?i).*\Q\sites.xml\E.*$ active default fileinfo fileinfo.md5 equals 2 2e7db2a31d0e3da4b25f49b9542a2e1a Summary: Total: 11