Create a filter

import { GlossaryTooltip, Render, Steps, DashButton } from "~/components";

Each protection system component (SYN flood protection or out-of-state TCP protection) should have at least one rule, but filters are optional.

:::note Filters only apply to Advanced TCP Protection. :::

Procedure

To create a filter for one of the system components:

	<DashButton url="/?to=/:account/network-security/ddos" />
2. Go to **Advanced Protection** > **Advanced TCP Protection**.
3. Under the system component for which you are creating the filter (**SYN Flood Protection** or **Out-of-state TCP Protection**), select **Create** next to the type of filter you want to create:
	- **Mitigation Filter**: The protection system will drop <GlossaryTooltip term="data packet">packets</GlossaryTooltip> matching the filter expression. - **Monitoring Filter**: The protection system will log
	packets matching the filter expression.
	- **Off Filter**: The protection system will ignore packets matching the filter expression.
4. Under **When incoming packets match**, define a filter expression using the Expression Builder (specifying one or more values for **Field**, **Operator**, and **Value**), or manually enter an expression using the Expression Editor. For more information, refer to [Edit rule expressions](/ruleset-engine/rules-language/expressions/edit-expressions/).
5. Select **Save**.