A very simple use case of filters would be to reject traffic from/to a given IP. It doesn't seem to be possible.

1. deploy netobserv, and get the IP of any workload that generates regular traffic (in and out). For this example, I have 10.128.2.27
2. create a filter, I tried two configs:
2a: [{action: Reject, cidr: 10.128.2.27/32}]
2b: [{action: Reject, cidr: 10.128.2.27/32}, {action: Accept, cidr: 0.0.0.0/0}]

With 2a: no more traffic is generated, everything is dropped
With 2b: it only rejects traffic from 10.128.2.27 but not traffic to 10.128.2.27

Both traffic from and to 10.128.2.27 should be rejected