Backing up what evanr said:
In the case of Cisco Firewalls, the default Tool Alias is Cisco PIX and IOS. If you have all your Firewalls logging to Local7, you may want to change that to "Cisco Firewalls." Then data would match the default filter.
I've also seen people use this on Nodes (or more specifically, Connector Profiles) where they change the default Windows Connector Aliases to something like "DC Application Log" and "DC System Log" and then they can create a filter for Domain Controller Events. The Tool Aliases can be pretty handy that way.