Ingestion Rules Examples

This page provides real-world ingestion rule examples for common scenarios. For operator syntax, see Ingestion Rules Operators. For post actions, see Ingestion Rules Post Actions. For general setup, see Configuring Ingestion Rules.

Remove a Problematic MAC Address

A shared ethernet connection used when imaging workstations may cause the same MAC address to appear on multiple devices, resulting in unintended correlation issues.

device key_exists ["id"] then remove_items network_interfaces.mac == "00:00:5E:00:53:AF"

This finds any network interface records containing this MAC address and removes it from the device.

Exclude Devices with Neither Open Ports Nor Hostname

When excluding a device, consider what you want to ingest. Excluding devices that have neither open ports nor a hostname is equivalent to: "I want to ingest devices that have an open port OR a hostname."

device key_exists ["hostname"]

device key_exists ["open_ports"]

Use these two rules together with the OR operator:

Why not combine into one rule?

device key_exists ["hostname", "open_ports"]

This requires both keys to exist on the device. key_exists checks whether all supplied key values exist — if any key is missing, the device is not ingested.

Exclude Data from an Acquired Company in Your CMDB

If you have added devices from an acquired company to your CMDB but do not want to ingest them into Axonius:

device.company != "Child Company"

Working with Boolean Values

While has_agent is a boolean field (True/False), the UI shows Yes/No. To ingest only devices with an agent, use the actual field value:

device.has_agent == "True"

Exclude Specific Classes from a CMDB

To filter specific classes from a ServiceNow fetch — for example, cmdb_ci_win_server, cmdb_ci_linux_server, cmdb_ci_unix_server — start by building a field segmentation to identify the devices to exclude.

8 Win Servers + 7 Unix Servers + 5 Linux Servers = 20 total devices to exclude. The ingestion rule should ignore 20 additional devices after implementation.

device.class_name not_in ["cmdb_ci_win_server", "cmdb_ci_linux_server", "cmdb_ci_unix_server"]

Filter AWS Resources from an Adapter

Ephemeral EC2 instances filtered from an AWS adapter may still appear in Axonius from other adapters that see them. To filter by cloud provider:

device.cloud_provider != "AWS"

This rule should exclude cloud-provider-tagged devices. However, devices without a cloud_provider field also fail this check — so you need an additional rule for devices that do not have the field at all:

device key_not_exists ["cloud_provider"]

Use these two rules together with the OR operator.

Exclude Expired Certificates

To filter out expired certificates from a Certificate Lifecycle Management system (such as Digicert, Sectigo, or Venafi), excluding all certificates that expired more than 30 days ago:

device.certificate.cert_expiry_date > date(now-30d)

This looks back 30 days and ingests all certificates that have expired within the last 30 days or have yet to expire.

Skip Physical Location Field for Devices by OS and Hostname Prefix

An organization uses hostname prefixes per device type. This complex ingestion rule ingests only devices where:

• Hostname starts with worg and OS is Windows, or
• Hostname starts with morg and OS is MacOS

And for ingested devices matching either rule, skips the physical_location field.

(device.hostname starts_with ["worg"] and device.os.type == "Windows") or (device.hostname starts_with ["morg"] and device.os.type == "MacOS") then skip_field ["physical_location"]

Ingest Specific Servers by Hostname Prefix and OS

The following rule covers this scenario:

• Hostname starts with SER_ AND OS is Windows → Do not ingest.
• Hostname starts with SER_ AND OS is Linux or any other OS → Ingest.
• Hostname does not start with SER_ and any OS → Ingest.

(device.hostname not_starts_with "SER_" or device.os.type != "windows")

Expected results:

Related Pages

• Setting Adapter Ingestion Rules — Overview and required permissions
• Configuring Ingestion Rules — Step-by-step setup procedures
• Ingestion Rules Operators — All supported filter operators
• Ingestion Rules Post Actions — Modify or drop fields before ingestion
• Ingestion Rule Statement Reference — Statement syntax reference