> For the complete documentation index, see [llms.txt](https://docs.dropzone.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.dropzone.ai/platform/settings/global-alert-project/migrating-from-advanced-filtering.md).

# Migrating From Advanced Filtering

Advanced Filtering was configured per integration under that integration's settings. Global Alert Filters replaces it with one centralized and ordered rule list covering every alert source.

If you used per-integration `Advanced Filtering` before enabling Global Alert Filters, your existing filters can carry over.

## Why should I switch?

Beyond consolidating your filters into one location, Global Advanced Filters has several features beyond Advanced Filtering's capabilities:

* **Per-rule enable/disable**

While Advanced Filtering only had a single on/off switch for an integration's entire filter list, each Global Alert Filter rule can be turned on and off individually.

* **A full audit trail**

Every evaluation is recorded for future analysis, allowing you to see in real time what your rules are doing and correct any errors. See [Reviewing filter activity](/platform/settings/global-alert-project/reviewing-filter-activity.md) for more information.

* **Archive and restore**

The ability to store your previously configured filters for future use, rather than deleting a filter wholesale to stop it running.

* **Multiple sources**

Global Alert Filter rules may apply to multiple alert sources, rather than being tied to one integration.

* **Improved filter options**

Global Alert Filter rules can filter post-enrichment, meaning they can exclude or include alerts based on entities, URLs, contextual data, and other associated alerts, none of which Advanced Filtering could see.

## After Enabling GAF

Immediately after Global Alert Filters is enabled for your environment, a one-time migration runs and creates a Global Alert Filter rule for each of your Advanced Filtering filters. These rules do not apply automatically, but show up as "Disabled" in the Configured tab. This allows you to edit them to ensure the correct configuration has been applied before enabling them.

{% hint style="warning" %}
Until you complete the process to switch over to Global Alert Filters detailed in this document, Advanced Filtering will continue to filter your Alerts.

Because the migration runs only once, anything you add to Advanced Filtering after it has run will not be picked up. Build new filtering directly in the Global Alert Filters page instead.
{% endhint %}

Migrated rules will have the following characteristics:

* Named with an `\Advanced Filtering` prefix
* Only apply to alerts coming from the original Alert Source Integration they were configured in
* Match the original filter description
* Run at the pre-enrichment stage

Migrated rules will keep your original filter description and order. Global Alert Filters operates according to the same first-match-wins principle as Advanced Filtering, so your order should be carried across exactly.

If your Advanced Filtering system excluded alerts by default (e.g. "If no filters match: Exclude alert"), the migration also adds a rule named `\[Advanced Filtering] default-drop` at the end of that integration's chain.

## What does not get migrated

Occasionally a filter is deliberately left behind rather than carried over incorrectly. This is uncommon, but if a filter you expected isn't in the list, it may be explained by one of the following:

* **The integration was disabled at the time of migration**

If an integration was switched off when you enabled GAF, any Advanced Filters you may have configured will not migrate. The migration only runs once, so you must recreate that integration's rules manually.

* **The filter expression could not be translated**

An expression that no longer parses or one relying on a structure that doesn't carry across will not migrate. In practice this is rare, and it usually indicates that the filter was already failing before the migration.

## Switching Over to Global Alert Filters

Rules will be automatically created in the GAF page. Enabling them is a manual process done one integration at a time.

{% hint style="info" %}
We recommend agreeing up front who to carry out each step of the process: your administrators, your Dropzone team, or the two together. The steps are the same either way.
{% endhint %}

To fully switch to Global Alert Filters, do the following:

### 1. Review the Migrated Rules

Open Global Alert Filters and look at the `\[Advanced Filtering]` rules for the integration in question, e.g. Splunk.

Verify that the migrated rules look correct and in proper order.

If a filter did not get migrated over, you may need to build a new one. See [Creating and Managing Rules](/platform/settings/global-alert-project/creating-and-managing-rules.md) for instructions on how to do so.

### 2. Enable the Migrated Rules

Click the kebab to the right of each rule row, then Enable them.

The Global Alert Filters and Advanced Filtering systems will act simultaneously.

### 3. Verify in the Usage Log

Wait until your instance has seen real traffic, then check your [Global Alert Filter Usage](/platform/settings/global-alert-project/reviewing-filter-activity.md). Confirm the migrated rules are matching the alerts you expect, with no errors.

### 4. Turn off Advanced Filtering

Once you have verified that the GAF are functioning correctly, navigate to Platform > Integrations. Locate the integration in question, open the Alert Source page, and switch "Use advanced filtering" off.

Global Alert Filters will now be solely responsible for that source.

{% hint style="warning" %}
Do not turn off Advanced Filtering before enabling the migrated rules. That leaves a window where nothing is filtering, and suppressed noise will flow straight into your investigation queue.
{% endhint %}