SIGNL4 filters incoming events using a keyword matching algorithm. Keywords are used to find a matching alert category which is then used to enrich an alert with colors, icons, push sounds, maps and so on. Alert categories can also be used to route alert to dedicated staff, to hide alerts or to prevent incoming events from being turned into alerts (keyword whitelist filtering).
By default, SIGNL4 scans the entire event content for matching keywords. It can then apply an 'AND' or 'OR' logic operator. This approach is little bit broad.
However, it is possible to work more precisely by telling SIGNL4 to match keywords only for named event parameters. Instead of searching the entire event payload for a keyword 'ABC' you can restrict the keyword search for a single event parameter, like the subject of an email event using the following syntax when defining a category keyword: 'subject ABC'.
So, you simply use the parameter name, a space and then the keyword you want to search for. This also works for custom parameters of your payload. So, if you webhook call payload contains a parameter named 'param1' you would use the keyword definition syntax 'param1 ABC' to only search in param1 for keyword ABC.
This facilitates a much more precise keyword matching and whitelist filtering algorithm.
Here is a sample screenshot.
Please check also the following article: