---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Select event rule filters

# Select event rule filters {#ariaid-title1}

Release version: Brazil  
Updated October 23, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 1 minute to read  
Configure event rule filters to target specific devices and users by operating system, location, department, or custom conditions.

## Before you begin

Confirm that the DEX plugin (sn_dex) is installed.

Role required: sn_dex.admin

## Procedure

1. In the primary navigation pane, select the DEX Administration icon (![]()).
2. Select Configure on the Alert rules card.  
   The list of alert rules appears.
3. Select Create new ruleEvent rule.  
   A new tab opens for the Create metric rule window, with the Select filters option preselected in the navigation pane.
4. Select an operating system under Select OS type.
5. Select the Applicable for Non-persistent VDIs toggle switch to apply this event rule to all the non-persistent virtual desktop infrastructures (VDIs).  
   Note:  
   When this toggle switch is on, only the Location option is available in the Apply filtering for devices field.
6. **Optional:** Apply conditional filtering for a device or a user.  
   The predefined filtering choices are Device and User.

   To add more filters, select + New condition set.  
   Note:  
   * Administrators can filter by selecting any available column from the Device (`cmdb_ci_computer`) or User (`sys_user`) tables. After a column is used as a filtering condition in any rule, it automatically becomes an enriched field.
   * Enriched fields are already synced to end-user devices. However, if you select a non-enriched field as a filter condition, the data might take up to 24 hours to sync across all devices.
   * Besides the default enriched values, you can select up to 15 non-enriched fields.
   {#event-rule-select-filters__ul_ajz_rvq_jhc}
7. Select Next.

## What to do next

For the next step, see [Define alert criteria](https://www.servicenow.com/docs/wzQ9Z03_xOyzTNJ0jPFIwA "Specify the event alert criteria by choosing the alert severity, defining thresholds, and specifying conditions for when the alert must be triggered.").

*[\>]: and then