# How to discard specific event from storing or correlation in SIEM to save resources

**URL:** <https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716>\
**Category:** SIEM\
**Created:** [April 29, 2021, 8:43pm UTC](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716 "2021-04-29T20:43:53Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zoot](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/zoot/32/87700_2.png) [@zoot](https://discuss.elastic.co/u/zoot)\
**Post date:** [April 29, 2021, 8:43pm UTC](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716/1 "2021-04-29T20:43:53Z")

</div>

Hi,

In SIEM systems events can be discard or filter to safe diskspace and avoid overloading SIEM from noisy events. This way SIEM resources can be managed at optimum levels.

For example windows event 5156 from all agents to be filtered or from specific agent.

How to achieve this from Elastic SIEM UI or some other manageable way ?

---

<div class="post-metadata">

**Author:** ![austinsonger](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/austinsonger/32/78994_2.png) [@austinsonger](https://discuss.elastic.co/u/austinsonger)\
**Post date:** [May 6, 2021, 11:02pm UTC](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716/2 "2021-05-06T23:02:20Z")

</div>

You can control what event is processed by Elastic by using [Ingest pipelines | Elasticsearch Guide [7.12] | Elastic](https://www.elastic.co/guide/en/elasticsearch/reference/current/ingest.html)

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [June 3, 2021, 11:02pm UTC](https://discuss.elastic.co/t/how-to-discard-specific-event-from-storing-or-correlation-in-siem-to-save-resources/271716/3 "2021-06-03T23:02:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.