How to filter reports based on age?
In certain cases, you might not be able to handle reports that are older than X days. This might be a legal or maybe even a technical thing and in some cases just your subjective choice on how to handle things.
Setting up a Filter in Inbound Processing is very simple and this exact "IsRecent" Filter is already part of the Default Inbound Processing Chain.
Opening the “IsRecent” node will show a form on the right side with all configuration options for this filter. The fields are more or less the same for all Filters.
Set a name, description and the actual logic of the filter. In our case, we want to operate on the event’s date and check if it is younger than 30 days (“30d”). Some other examples of useful filters may be:
- Check if the event IP is in your configured networks.
- Check if the event IP is in a network with a specific tag.
- Filter based on the type of the event (spam, copyright, etc).
- Filter based on senders email address.