Observer filter
Filters that you built using Observer may be used by REST API calls using the obsfilter keyword.
Like IP Pairs, which can be grouped together, so may “Observer filters.” Observer filters can be pre-built, making them ideal when you need to use a complex filter. Also like the IP Pairs filter you may use groupings. To group options together, you must use parentheses “( )”. You may also use these keywords:
You must exclude a single Observer filter by using the ! character. Currently unsupported is the use of the NOT keyword preceding the Observer filter.
An Observer filter name may contain any characters that are valid in a Windows Registry subkey name, including the double quote (") character. The parameter for an obsfilter keyword must also be quoted; any quotes that appear in the filter name must be escaped with a \ character, which itself must also be escaped, as in the last example.
Single filter named “Multiple Addresses”
"filter": "obsfilter \"Multiple Addresses\""
Combining filters using OR
"filter": "obsfilter \"Complex Filter\" OR \"Multiple Addresses\""
A filter with quotes in its name
"filter": "obsfilter \\\"A filter with quotes in its name\\\""