Command Filter

Command Filter inspects commands sent during an asset session and compares them with command groups. When a command matches, the rule's action decides what happens; the default is to reject the command. Filters can target all users, specific users, or users matched by attributes, and can be limited to particular assets and accounts.

Open the page from Console > ACLs > Command Filter.

Figure 1: Command Filter page with the Command Filters and Command Groups tabs.

Overview

The page has two tabs:

Command Filters: rules that bind users, assets, accounts, and command groups together with an action.
Command Groups: reusable sets of commands or regular expressions that filters reference.

Command filters are scoped to the current organization. The filter list columns are Name, Command group, Priority, Active, Comment, and Actions.

Before you begin

Sign in with an account that can manage ACLs.
Create at least one command group. A filter cannot be saved without one.

Create a command group

Open the Command Groups tab and click Create.

In Create command group, enter a name, choose a type, and list the commands or expressions.

Click Submit.

Field	Description
Name	Required. Command group name, unique within the organization.
Type	Command for literal commands, or Regex for a regular expression.
Content	Required. One command or expression per line, for example `rm` or `reboot`.
Ignore case	When selected, matching is case-insensitive. On by default.
Comment	Optional.

With the Command type, each line is matched as a command, with word boundaries applied where appropriate. Use Regex when you need an expression that the literal type cannot express.

Create a command filter

Open the Command Filters tab and click Create.

In Create command filter, fill in the fields below and select the command groups to match.

Click Submit.

Figure 2: Create command filter with users, assets, accounts, and command groups.

Field reference

Group	Field	Description
Basic	Name	Required. Filter name, unique within the organization.
Basic	Priority	Integer from 1 to 100. Defaults to 50; the lower the value, the earlier the rule is matched.
Users	Users	All users, Specified users, or Attribute filter.
Assets	Assets	All assets, Specified assets, or Attribute filter.
Accounts	Accounts	All accounts or Specified accounts.
Command groups	Command groups	One or more command groups to match.
Action	Action	What happens when a command matches. Defaults to Reject.
Other	Active	When selected, the rule takes effect.
Other	Comment	Optional.

Note

The Command group drop-down stays empty until at least one command group exists. Create the group first, then return to the filter.

Create rules with the AI assistant

New in v5.1.0

Command filter rules support AI-assisted drafting and conversational creation through the AI assistant. Describe the commands to block and the users, assets, and accounts in scope, and the assistant drafts the rule. The configuration experience for command filter rules and command groups.

Review the command groups the rule references, its scope, and the action before you enable it.

Before you begin:

An administrator has enabled the AI assistant and configured the model connection. See AI Assistant.
Your role includes the Chat AI permission.
You can manage ACLs, and the command groups the rule references already exist.

Figure 3: Create a command filter ACL

Check filtered commands

Commands rejected by a filter are not executed on the asset. Review them, together with commands that were allowed, in Session Commands. When a rule uses review or another approval action, the request appears in the ticket workflow.

Version history

Version	Change
v5.1.0	Added AI-assisted drafting and conversational creation for command filter rules.

#Command Filter

#Overview

#Before you begin

#Create a command group

#Create a command filter

#Field reference

#Create rules with the AI assistant

#Check filtered commands

#Version history

#Related topics