> For AI agents: the complete documentation index is available at https://www.jumpserver.com/docs/llms.txt, the full documentation bundle is available at https://www.jumpserver.com/docs/llms-full.txt.

# Command Filter

**Command Filter** inspects commands sent during an asset session and compares
them with command groups. When a command matches, the rule's action decides what
happens; the default is to reject the command. Filters can target all users,
specific users, or users matched by attributes, and can be limited to particular
assets and accounts.

Open the page from **Console > ACLs > Command Filter**.

![Figure 1: Command Filter page with the Command Filters and Command Groups tabs.](/images/v5/jumpserver/v5_admin_acls_03.png)

## Overview

The page has two tabs:

- **Command Filters**: rules that bind users, assets, accounts, and command
  groups together with an action.
- **Command Groups**: reusable sets of commands or regular expressions that
  filters reference.

Command filters are scoped to the current organization. The filter list columns
are Name, Command group, Priority, Active, Comment, and Actions.

## Before you begin

- Sign in with an account that can manage ACLs.
- Create at least one command group. A filter cannot be saved without one.

## Create a command group


1

Open the **Command Groups** tab and click **Create**.

2

In **Create command group**, enter a name, choose a type, and list the
commands or expressions.

3

Click **Submit**.

| Field       | Description                                                                 |
| ----------- | --------------------------------------------------------------------------- |
| Name        | Required. Command group name, unique within the organization.               |
| Type        | **Command** for literal commands, or **Regex** for a regular expression.    |
| Content     | Required. One command or expression per line, for example `rm` or `reboot`. |
| Ignore case | When selected, matching is case-insensitive. On by default.                 |
| Comment     | Optional.                                                                   |

With the **Command** type, each line is matched as a command, with word
boundaries applied where appropriate. Use **Regex** when you need an expression
that the literal type cannot express.

## Create a command filter


1

Open the **Command Filters** tab and click **Create**.

2

In **Create command filter**, fill in the fields below and select the command
groups to match.

3

Click **Submit**.

![Figure 2: Create command filter with users, assets, accounts, and command groups.](/images/v5/jumpserver/v5_admin_acls_04.png)

### Field reference

| Group          | Field          | Description                                                                                  |
| -------------- | -------------- | -------------------------------------------------------------------------------------------- |
| Basic          | Name           | Required. Filter name, unique within the organization.                                       |
| Basic          | Priority       | Integer from 1 to 100. Defaults to 50; the lower the value, the earlier the rule is matched. |
| Users          | Users          | **All users**, **Specified users**, or **Attribute filter**.                                 |
| Assets         | Assets         | **All assets**, **Specified assets**, or **Attribute filter**.                               |
| Accounts       | Accounts       | **All accounts** or **Specified accounts**.                                                  |
| Command groups | Command groups | One or more command groups to match.                                                         |
| Action         | Action         | What happens when a command matches. Defaults to **Reject**.                                 |
| Other          | Active         | When selected, the rule takes effect.                                                        |
| Other          | Comment        | Optional.                                                                                    |


Note

The **Command group** drop-down stays empty until at least one command group
exists. Create the group first, then return to the filter.

## Create rules with the AI assistant

New in v5.1.0
Command filter rules support AI-assisted
drafting and conversational creation through the AI assistant. Describe the
commands to block and the users, assets, and accounts in scope, and the assistant
drafts the rule. The configuration experience for
command filter rules and command groups.

Review the command groups the rule references, its scope, and the action before
you enable it.

Before you begin:

- An administrator has enabled the AI assistant and configured the model
  connection. See [AI Assistant](https://www.jumpserver.com/docs/features/general/support/ai-assistant.md).
- Your role includes the Chat AI permission.
- You can manage ACLs, and the command groups the rule references already exist.

![Figure 3: Create a command filter ACL](/images/v5/jumpserver/v5_console_acl_command_filter_create.png)

## Check filtered commands

Commands rejected by a filter are not executed on the asset. Review them,
together with commands that were allowed, in
[Session Commands](https://www.jumpserver.com/docs/features/audits/sessions/session-commands.md). When a rule uses
review or another approval action, the request appears in the ticket workflow.

## Version history

| Version | Change                                                                           |
| ------- | -------------------------------------------------------------------------------- |
| v5.1.0  | Added AI-assisted drafting and conversational creation for command filter rules. |

## Related topics

- [ACLs](https://www.jumpserver.com/docs/features/console/policies/acls/index.md)
- [Asset Connect](https://www.jumpserver.com/docs/features/console/policies/acls/asset-connect.md)
- [Session Commands](https://www.jumpserver.com/docs/features/audits/sessions/session-commands.md)
- [Authorizations](https://www.jumpserver.com/docs/features/console/policies/authorizations.md)