# Filter Uncommon Host Processes

**URL:** <https://discuss.elastic.co/t/filter-uncommon-host-processes/197874>\
**Category:** SIEM\
**Created:** [September 3, 2019, 1:38pm UTC](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874 "2019-09-03T13:38:18Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [September 3, 2019, 1:38pm UTC](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874/1 "2019-09-03T13:38:18Z")

</div>

Hello,

Read here ([Uncommon Processes](https://discuss.elastic.co/t/uncommon-processes/190115)) that the Uncommon Processes query is an aggregation on `process.name` sorted by host cardinality first (cardinality of `host.name` where this process name occurs) and number of documents second.

The result is that the list if full of processes from our Rundeck server, which generates a unique id for each job running.

Is there any way to prevent these processes from showing up in SIEM? They look like:

548-129241-loca  
549-129241-loca  
550-129241-loca

Grtz

Willem

---

<div class="post-metadata">

**Author:** ![willemdh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/willemdh/32/16922_2.png) [@willemdh](https://discuss.elastic.co/u/willemdh)\
**Post date:** [September 26, 2019, 10:08am UTC](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874/2 "2019-09-26T10:08:59Z")

</div>

I'm assuming there is no way to exclude processes somehow in hte SIEM Host overview?

---

<div class="post-metadata">

**Author:** ![tudor](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/tudor/32/3753_2.png) [@tudor](https://discuss.elastic.co/u/tudor)\
**Post date:** [September 27, 2019, 11:05am UTC](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874/3 "2019-09-27T11:05:11Z")

</div>

Sorry for missing to reply. No, there's no way to add some sort of global filter at the moment. It's something we would consider.

You can filter them out via the KQL bar, but that will be only for the current view.

I'll raise this with the team to see if we can think of a solution.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [October 25, 2019, 11:05am UTC](https://discuss.elastic.co/t/filter-uncommon-host-processes/197874/4 "2019-10-25T11:05:12Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.