Domain and Logging Filtering
Domain filtering controls where Keep Aware watches and what it records. Use excluded domains to stop monitoring specific domains entirely, and use logging filters to keep only the browser activity you care about from a domain while dropping the rest before it reaches your tenant. Both are useful for reducing noise and for keeping sensitive internal sites out of your logs.
Getting started
Both settings live on the same tab. Navigate to Settings, then select Domain filtering under the General group. The tab has two sections: Excluded domains at the top and Logging filters below it. Every change saves immediately through a side panel, so there's no page-level Save button.
Excluded domains
Excluded domains are domains that Keep Aware ignores entirely. The browser extension won't track activity or run any analysis, such as threat, credential, or data-exposure detection, on pages served from these domains. Nothing from an excluded domain is analyzed or logged.
Exclude a domain when you never want Keep Aware to observe it, such as an internal admin tool, a healthcare portal, or a banking site your policies shouldn't touch.
Editing excluded domains
- On the Domain filtering tab, find the Excluded domains row.
- Click Edit to open the side panel.
- Enter one domain per line.
- Save the panel. The list updates immediately.
Enter a bare domain without https://, paths, or spaces. Valid entries look like example.com, www.example.com, or localhost. An entry that contains a scheme, a path, or whitespace is rejected with an inline error.
Logging filters
Logging filters give you finer control than exclusion. Instead of ignoring a domain completely, a filter lets you keep only certain browser activity from that domain and drop everything else. Filters are evaluated on Keep Aware's servers as events arrive, so dropped events are never stored in your tenant.
Use logging filters to cut routine noise or to limit what a monitored domain records. A common setup is to keep only policy-flagged activity from a busy internal application and drop ordinary page visits and typing.
How a filter decides what to keep
Each filter targets one or more domains and defines what to keep from them along two dimensions:
- Type — the kinds of browser activity to keep, such as uploads or downloads.
- Policy outcome — the policy results to keep, such as anything that triggered a safeguard or a threat.
For an event from a matched domain, Keep Aware keeps the event when its type is in the filter's Type list or its result is in the filter's Policy outcome list. Every other event from those domains is dropped.
Leaving a dimension empty keeps nothing by that dimension. It does not mean "keep everything." So a filter with an empty Type and an empty Policy outcome keeps nothing at all and drops every event from its domains. To keep only policy-flagged activity and drop routine page and input noise, leave Type empty and select the policy outcomes you want under Policy outcome.
Events from domains that no filter targets are unaffected and continue to log as usual.
Creating a filter
- On the Domain filtering tab, go to the Logging filters section.
- Click Add filter to open the side panel.
- Under Domains, add each hostname or domain the filter applies to.
- Under Type, select the event types to keep, or leave it empty.
- Under Policy outcome, select the policy outcomes to keep, or leave it empty.
- Click Save. The filter appears in the table.
Filter fields
| Field | What it does |
|---|---|
| Domains | The hostnames or domains this filter applies to, such as example.com or mail.example.com. An entry also matches everything beneath it, so a domain covers its subdomains. A filter targets at most 10 domains. |
| Type | The event types to keep for matched domains. Leave empty to keep none by type. |
| Policy outcome | The policy outcomes to keep for matched domains. Leave empty to keep none by policy. |
The Type field offers these event types: Page visit, Input, Upload, Download, Credential input, Copy, Paste, Link, Request, and Fetch.
The Policy outcome field offers Label, Safeguard, and Threat.
Editing and removing filters
Existing filters appear in a table with three columns: Domains, Event types, and Created date. The Event types column summarizes each filter's keep rule.
To change a filter, click its row or the edit icon, adjust the fields, and click Save.
To delete a filter, click the remove icon on its row. Keep Aware asks you to confirm, because removing a filter permanently deletes it and can't be undone. Once removed, the domains it covered log normally again.
Frequently asked questions
| Question | Answer |
|---|---|
| What's the difference between an excluded domain and a logging filter? | An excluded domain turns off all monitoring and logging for a domain. A logging filter keeps monitoring the domain but records only the activity you choose and drops the rest. |
| Are dropped events stored anywhere? | No. Logging filters run at ingest, so dropped events are never written to your tenant. |
Does a filter for example.com also cover its subdomains? | Yes. A domain entry matches everything beneath it, so example.com also covers app.example.com and other subdomains. |
| How many domains can one logging filter target? | Up to 10. |
| What happens if I leave both Type and Policy outcome empty? | The filter keeps nothing and drops every event from its domains. Add a domain to Excluded domains instead if that's the goal, since it also skips analysis. |
| I removed a filter by mistake. Can I get it back? | No. Removing a filter is permanent. Recreate it with the same domains and selections. |