A filter block with only one condition configured which states: artifact.*.cef .sourceAddress !- , would

permit only non-null IP addresses to pass forward to the next block. The !- operator means “is not

null”. The other options are not valid because they either include null values or other fields than

sourceAddress. See Filter block for more details. A filter block in Splunk SOAR that is configured with

the condition artifact.*.cef.sourceAddress != (assuming the intention was to use "!=" to denote 'not

equal to') is designed to allow data that has non-null sourceAddress values to pass through to

subsequent blocks. This means that any artifact data within the container that includes a

sourceAddress field with a defined value (i.e., an actual IP address) will be permitted to move

forward in the playbook. The filter effectively screens out any artifacts that do not have a source

address specified, focusing the playbook's actions on those artifacts that contain valid IP address

information in the sourceAddress field.