The simplest method would be to put the below transform under the
/Perf/Interface (or the EventClass of your choice)
if "/Network/Remote_sites" in getattr(evt, 'DeviceClass', ''):
evt._action = "drop"
That will drop any events for the /Perf/Interface EventClass for devices
under the /Network/Remote_sites DeviceClass.
Make sense?
