Event Filters determine which collected SQL events should be kept for processing by the Collection Server. Like your audit settings, the Event Filters should correlate with the SQL events you need to track in order to meet your compliance objectives.
After receiving the trace files from the SQL Compliance Manager Agent, the Collection Server applies your Event Filters. Any matching events are permanently deleted and eliminated from the data stream. All remaining events are processed for alerts and stored in the appropriate Repository database.
When you enable Sensitive Column auditing on a table, the Collection Server preserves all SELECT events associated with the audited columns even though you may have created an event filter to exclude SELECT events. Therefore, when using an Event Filter for a specific Login, all events captured get filtered except for the Sensitive Column SELECT operations.