Connector Appliance-SmartConnector Runtime Filters
I'm new to Arcsight and I'm trying to setup a Filter Out option on my Connector appliance. I would like to filter out an IP address on my connector but I'm having a hard time determining the correct syntax.
I created a Netflow connector on my connector appliance and I wanted to reduce the number of events being passed to my Logger. I've gone into the connector Runtime Parameters and I've added, destinationAddress EQ <IP Address>,to the Filter Out option. I'm using "EQ" because the SmartConnector User Guide said that was the parameter to use. When I tried that nothing happened. When I changed the filter to destinationAddress = <IP Address> all flows stopped.
What is the proper syntax for this filter?
Also, is it necessary to reboot the connector appliance in order to have these filters enforced?