The new docs.trellix.com offers a modernized UI and AI-powered features like conversational searches. Content is currently available only in English. Other languages will be available in mid-October 2026. We hope you enjoy the new experience.

Access Protection subrule targets

Prev Next

Targets are files or processes on which a subrule action is applied.

Depending on the --subruletype, the targets can differ. A subrule must have at least one target.

Multiple targets can be added at the same time for a subrule.

When --subruletype is file, the following target parameters can be used.

Commands for subrule target file

Command

Description

--includetargetfile [file1, file2…]

Specifies the target files that are included in a file subrule. The values for file can be file, name, or path.

Wildcards [*, ?, and **] and comma-separated values are also allowed.

--includetargetdstfile [file1, file2…]

Specifies the destination file or paths that are included in a file subrule. The target operations available for a file subrule are Rename, Hardlink, or Symlink.

Wildcards [*, ?, and **] and comma-separated values are also allowed.

--excludetargetfile [file1, file2…]

Specifies the target files that are excluded when defining the subrule target based on either the file, name, or path.

Wildcards [*, ?, and **] and comma-separated values are also allowed.

--excludetargetdstfile [file1, file2…]

Specifies the target destination file or paths that are excluded for a file subrule. The target operations available for a file subrule are Rename, Hardlink, or Symlink.

Wildcards [*, ?, and **] and comma-separated values are also allowed.



Subrule targets when the subrule type is process:

Commands for subrule target process

Command

Description

--includetargetprocess [name1:file1, name2:file2,…]

Specifies the target process that is included when applying the subrule. The target process has a name and a file. The value for file can be either the file name or path.

Wildcards [*, ?, and **] and comma-separated values are also allowed.

--excludetargetprocess [name1:file1, name2:file2,…]

Specifies the target process that must be excluded when applying the subrule. The target process has a name and a file. The value for file can be either the file name or path.

Wildcards [*, ?, and **] and comma-separated values are also allowed.