---
updatedAt: 2026-08-09T16:24:40.000Z
agentTools:
projectIndex: https://docs.axonius.com/llms.txt
---
# Ingestion Rules Examples
This page provides real-world ingestion rule examples for common scenarios.
This page provides real-world ingestion rule examples for common scenarios. For operator syntax, see [Ingestion Rules Operators](/docs/ingestion-rules-operators). For post actions, see [Ingestion Rules Post Actions](/docs/ingestion-rules-post-actions). For general setup, see [Configuring Ingestion Rules](/docs/configuring-ingestion-rules).
***
## Remove a Problematic MAC Address
A shared ethernet connection used when imaging workstations may cause the same MAC address to appear on multiple devices, resulting in unintended correlation issues.
```text
device key_exists ["id"] then remove_items network_interfaces.mac == "00:00:5E:00:53:AF"
```
This finds any network interface records containing this MAC address and removes it from the device.
***
## Exclude Devices with Neither Open Ports Nor Hostname
When excluding a device, consider what you want to *ingest*. Excluding devices that have neither open ports nor a hostname is equivalent to: "I want to ingest devices that have an open port **OR** a hostname."
```text
device key_exists ["hostname"]
```
```text
device key_exists ["open_ports"]
```
Use these two rules together with the OR operator:
**Why not combine into one rule?**
```text
device key_exists ["hostname", "open_ports"]
```
This requires **both** keys to exist on the device. `key_exists` checks whether all supplied key values exist — if any key is missing, the device is not ingested.
***
## Exclude Data from an Acquired Company in Your CMDB
If you have added devices from an acquired company to your CMDB but do not want to ingest them into Axonius:
```text
device.company != "Child Company"
```
***
## Working with Boolean Values
While `has_agent` is a boolean field (True/False), the UI shows Yes/No. To ingest only devices with an agent, use the actual field value:
```text
device.has_agent == "True"
```
***
## Exclude Specific Classes from a CMDB
To filter specific classes from a ServiceNow fetch — for example, `cmdb_ci_win_server`, `cmdb_ci_linux_server`, `cmdb_ci_unix_server` — start by building a field segmentation to identify the devices to exclude.
8 Win Servers + 7 Unix Servers + 5 Linux Servers = 20 total devices to exclude. The ingestion rule should ignore 20 additional devices after implementation.
```text
device.class_name not_in ["cmdb_ci_win_server", "cmdb_ci_linux_server", "cmdb_ci_unix_server"]
```
***
## Filter AWS Resources from an Adapter
Ephemeral EC2 instances filtered from an AWS adapter may still appear in Axonius from other adapters that see them. To filter by cloud provider:
```text
device.cloud_provider != "AWS"
```
This rule should exclude cloud-provider-tagged devices. However, devices without a `cloud_provider` field also fail this check — so you need an additional rule for devices that do not have the field at all:
```text
device key_not_exists ["cloud_provider"]
```
Use these two rules together with the OR operator.
***
## Exclude Expired Certificates
To filter out expired certificates from a Certificate Lifecycle Management system (such as Digicert, Sectigo, or Venafi), excluding all certificates that expired more than 30 days ago:
```text
device.certificate.cert_expiry_date > date(now-30d)
```
This looks back 30 days and ingests all certificates that have expired within the last 30 days or have yet to expire.
***
## Skip Physical Location Field for Devices by OS and Hostname Prefix
An organization uses hostname prefixes per device type. This complex ingestion rule ingests only devices where:
* Hostname starts with `worg` **and** OS is Windows, **or**
* Hostname starts with `morg` **and** OS is MacOS
And for ingested devices matching either rule, skips the `physical_location` field.
```text
(device.hostname starts_with ["worg"] and device.os.type == "Windows") or (device.hostname starts_with ["morg"] and device.os.type == "MacOS") then skip_field ["physical_location"]
```
***
## Ingest Specific Servers by Hostname Prefix and OS
The following rule covers this scenario:
* Hostname starts with `SER_` **AND** OS is Windows → Do **not** ingest.
* Hostname starts with `SER_` **AND** OS is Linux or any other OS → Ingest.
* Hostname does **not** start with `SER_` and any OS → Ingest.
```text
(device.hostname not_starts_with "SER_" or device.os.type != "windows")
```
Expected results:
| Hostname | OS | Result |
| ------------- | ------- | ------------ |
| SER\_123 | windows | Not ingested |
| SER\_124 | Linux | Ingested |
| Linux\_ser123 | windows | Ingested |
***
## Related Pages
* [Setting Adapter Ingestion Rules](/docs/setting-adapter-ingestion-rules) — Overview and required permissions
* [Configuring Ingestion Rules](/docs/configuring-ingestion-rules) — Step-by-step setup procedures
* [Ingestion Rules Operators](/docs/ingestion-rules-operators) — All supported filter operators
* [Ingestion Rules Post Actions](/docs/ingestion-rules-post-actions) — Modify or drop fields before ingestion
* [Ingestion Rule Statement Reference](/docs/ingestion-rule-statement-reference) — Statement syntax reference