# Mandiant Event Filter Rules API

**Canonical:** https://apis.io/apis/mandiant/mandiant-event-filter-rules-api/  
**Provider:** Mandiant — https://apis.io/providers/mandiant/  
**Base URL:** https://api.intelligence.mandiant.com  
**Documentation:** https://docs.mandiant.com/home/mati-threat-intelligence-api-v3

Mandiant Event Filter Rules API is one of 61 APIs that [Mandiant](https://apis.io/providers/mandiant/) publishes on the [APIs.io](https://apis.io/) network, described by a machine-readable OpenAPI specification. This API exposes 12 JSON Schema definitions. Tagged areas include Event Filter Rules. The published artifact set on APIs.io includes an OpenAPI specification, API documentation, and 12 JSON Schemas.

The suppressed event filter rule API endpoints interact with the rules governing an event matching a Job Action. An suppressing or dropping EventFilterRule will prevent an Integration event from having a normal relationship with a Job Action. A suppressed or dropped event will not contribute to the prevented/alerted/detected/missed set of statistics for a Job Action. The event's relationship will be considered suppressed or dropped depending on the rule configuration and the global Director settings. A kept EventFilterRule will override suppressing or dropping rules depending on the numerical priority. This can be used to establish "normal" or expected event matching behavior. For example, a priority 5 rule to suppress all events from Host CLI actions can be overridden by a priority 3 rule to keep all events from a particular Integration. A Suppressing or Dropping EventFilterRule differ from a normal IntegrationEventFilter in the way the event and the Job Action relate to each other. * Events that are Suppressed or Dropped via EventFilterRules and not by IntegrationEventFilters will not contribute any statistics to the Job Action, the event will not be considered a "real" event for the Job Action, and the only record that the event has any relationship at all to the Job Action is that there will be a SuppressedEvent/DroppedEvent object created and attached to the Job Action afterward. * Events that are altered by the IntegrationEventFilter and not by EventFilterRules will still be considered "real" events attached to the Job Action, however the event cannot be considered "detected" by the Job Action. * Events that are eligible to be Suppressed or Dropped by an EventFilterRule but also eligible to be altered by an IntegrationEventFilter will be Suppressed or Dropped only. The event will not be linked to the Job Action and therefore will not be considered detected (or prevented or missed or anything)

## Operations (7)

| Method | Path | Summary |
|---|---|---|
| GET | `/event_filter_rules.json` | List all Event Filter Rules on the Director |
| POST | `/event_filter_rules.json` | Create a new Event Filter Rule in the Director |
| GET | `/event_filter_rules/{id}.json` | List all Event Filter Rules on the Director for a given Job Action |
| PUT | `/event_filter_rules/{id}.json` | Clone and alter an existing Event Filter Rule in the Director |
| DELETE | `/event_filter_rules/{id}.json` | Disable an Event Filter Rule so it no longer applies to the Director |
| GET | `/event_filter_rules/action/{action_vid}.json` | List all Event Filter Rules on the Director related to an Action |
| GET | `/event_filter_rules/rule_options.json` | Show all existing parameter value options for an Event Filter Rule |

## Machine-readable artifacts (17)

- **OpenAPI** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/openapi/mandiant-event-filter-rules-api-openapi.yml
- **Documentation** — https://docs.mandiant.com/home/digital-threat-monitoring-api
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-alert-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-monitor-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-verified-domain-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-email-setting-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-doc-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-doc-search-response-schema.json
- **Documentation** — https://docs.mandiant.com/home/asm-api
- **Documentation** — https://docs.mandiant.com/home/ma-sv-api
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-run-job-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-file-library-object-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-integration-type-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-create-bulk-job-schema.json
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-security-zone-schema.json
- **Documentation** — https://docs.mandiant.com/home/msv-41470-api
- **JSONSchema** — https://raw.githubusercontent.com/api-evangelist/mandiant/refs/heads/main/json-schema/mandiant-msi-integration-schema.json

## Other Mandiant APIs (12)

- [Mandiant Threat Intelligence API v3](https://apis.io/apis/mandiant/mandiant-threat-intelligence-api-v3/)
- [Mandiant Action user profiles API](https://apis.io/apis/mandiant/mandiant-action-user-profiles-api/)
- [Mandiant Actions API](https://apis.io/apis/mandiant/mandiant-actions-api/)
- [Mandiant Actors API](https://apis.io/apis/mandiant/mandiant-actors-api/)
- [Mandiant Alert Analysis API](https://apis.io/apis/mandiant/mandiant-alert-analysis-api/)
- [Mandiant Alert Audit API](https://apis.io/apis/mandiant/mandiant-alert-audit-api/)
- [Mandiant Alerts API](https://apis.io/apis/mandiant/mandiant-alerts-api/)
- [Mandiant Analyze API](https://apis.io/apis/mandiant/mandiant-analyze-api/)
- [Mandiant Audit Logs API](https://apis.io/apis/mandiant/mandiant-audit-logs-api/)
- [Mandiant Bulk Jobs API](https://apis.io/apis/mandiant/mandiant-bulk-jobs-api/)
- [Mandiant Cloud Profiles API](https://apis.io/apis/mandiant/mandiant-cloud-profiles-api/)
- [Mandiant Collection Runs API](https://apis.io/apis/mandiant/mandiant-collection-runs-api/)

## Tags

Event Filter Rules

---

Profiled by [API Evangelist](https://apievangelist.com) and published on [APIs.io](https://apis.io/apis/mandiant/mandiant-event-filter-rules-api/). The API's provider profile, Kin Score and agent-readiness rating are at https://apis.io/providers/mandiant/.