B-G

I tried one more thing yesterday, I removed the Application name from the filter (We had named them as the scanners that we were using ) (Though it was just a descriptive field) and now it is working as expected. Looking at your filter setup confirms this configuration method as well. Thanks for your help all.

Following on from Tim Jones above, We have log / block / notify all set to "No" and are still getting alerts, anything else to try ?