1. A method for filtering event data in a network comprising: defining a plurality of discrete filtering rules, each of the plurality of rules performing at least one of a permit, deny, log, and rewrite function; assembling at least a first and second of the plurality of rules into an ordered sequence to form a first rule set; assembling at least a third and a fourth of the plurality of rules into an ordered sequence to form a second rule set; employing the first rule set in an appliance associated with a customer network; and employing the second rule set in a server associated with a network management system.