> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/platform/settings/global-alert-project.md).

# Global Alert Filters

{% hint style="info" %}
Global Alert Filters is an administrator-only feature, and it is enabled per environment. If you do not see it in the navigation, contact our Customer Success team.
{% endhint %}

Dropzone is an adaptive and customizable platform. If you wish, you may create custom Global Alert Filters using [CEL](https://cel.dev/) (Common Expression Language) expressions to route or suppress inbound alerts before they reach your investigation cue. This allows you to reduce noise and busywork and prioritize only the most important threats.

Each incoming alert will be tested against your rule expressions. When an alert matches the parameters, that rule will automatically filter the alert, either keeping it for investigation or skipping it. When no custom rule matches, the Global Default Rule decides.

{% hint style="info" %}
This feature is designed to replace the `Advanced Filtering` feature in individual Alert Source Integrations with a single, centralized filtering layer that applies across all of your alert sources. If you use Advanced Filtering today, your existing filters will carry over automatically. See [Migrating from Advanced Filtering](/platform/settings/global-alert-project/migrating-from-advanced-filtering.md) for more information.
{% endhint %}

## The Global Alert Filters Page

You may locate Global Alert Filters by navigating to Platform Settings > Global Alert Filters using the side navigation.

From the Global Alert Filters page you can:

1. See the complete list of existing rules, both Configured (live) and Archived (retired)
2. [Create and manage rules](/platform/settings/global-alert-project/creating-and-managing-rules.md) that match alerts on any field (e.g. severity, title, source, raw payload, tenant, and more)
3. Order your rules according to priority
4. Search and filter existing rules according to their Names, Sources, Actions, and Status
5. Edit, Enable/Disable, Duplicate, and Archive/Restore existing rules
6. Set the Global Default Rule to either allow or exclude alerts no rule filter matched

<figure><img src="https://435022081-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FmBVcKuiytGCsIDpL70BC%2Fuploads%2Fgit-blob-26d3d4d0104d512884e98702dce85b5ee1608b30%2Fui-gaf-overview-page.png?alt=media" alt=""><figcaption><p>The Global Alert Filters Page</p></figcaption></figure>

## How Filtering Works

When an alert arrives, Global Alert Filters evaluate your rules in order:

1. Rules are applied based on filtering stage. All pre-enrichment rules are applied before post-enrichment
2. Each enabled rule whose scope covers the alert is checked in turn. Rules scoped to a different source or tenant are passed over without being evaluated
3. The first rule that matches decides the outcome — `Include Alert` keeps the alert, `Skip Alert` suppresses it
4. If no rule matches, the Global Default Rule applies

Skipped alerts do not appear as [investigations](https://docs.dropzone.ai/platform/investigations), but they are recorded in the Global Alert Filter Usage page. You will have a full audit trail of what was filtered and why.

{% hint style="warning" %}
Filtering is not bypassed when a rule fails. If a rule's expression errors at evaluation time, that rule is treated as if it does not match and evaluation continues to the next rule. Be sure to check the [Global Alert Filter Usage page](/platform/settings/global-alert-project/reviewing-filter-activity.md) for errors after making any changes.
{% endhint %}

## The Global Default Rule

The Global Default Rule decides what happens to an alert when no rule matched it, as well as mandating skip reasons and determining how long rule evaluation logs are kept. To modify it, simply click it and modify its values.

### Default Action

Select either "Include Alert" (allowing alerts that no rule matched to be investigated) or "Skip Alert" (excluding all alerts that matched no rules) as your default action.

### Skip Reasons

Skip reasons appear in the Global Alert Filter Usage page and on the events attached to skipped alerts, so anyone reviewing later understands why an alert was filtered.

Checking the box labeled "Require a skip reason when alerts are skipped" will ensure that all skipped alerts will include an explanation, keeping your audit trail meaningful and improving troubleshooting.

### Log Retention (Days)

Every rule evaluation is recorded and logging cannot be disabled. This setting controls how many days of activity are kept before older entries are automatically pruned. The default is 30 days.

You can access these logs in the Global Alert Filter Usage page to [review your filter activity](/platform/settings/global-alert-project/reviewing-filter-activity.md) at any time.

## Filtering Styles

The combination of your rules and your Global Default Rule can lead to two main filtering styles.

Using a Global Default rule of "Include Alert" in combination with mainly "Skip Alert" rules will lead to a Blocklist filtering system, which suppresses known noise while still allowing you to investigate potentially suspicious behavior. This is the default and the most common setup.

Using a Global Default rule of "Skip Alert" in combination with mainly "Include Alert" rules will lead to an Allowlist filtering system, which only lets through the alerts you deem high priority.

{% hint style="warning" %}
If you set the Global Default Rule to "Skip Alert" but have no "Include Alert" rules, every alert will be skipped. The Global Alert Filters page shows a prominent warning when this happens.
{% endhint %}