Add attribute-based rules

You can create rules based on one or more attributes of a file to allow, block, or monitor its execution.

Enter the command with attribute type as command_line:

sadmin ruleengine add <ruletype> processname command_line <operation> <REGEX/STRING>

This table describes the command's tokens and their functionality.

Token	Possible values	Description
Ruletype	allow block monitor	Allows you to create a rule to allow, block or monitor execution.
Attributetype	command_line	Defines the `command_line` argument with which a process is launched. The attribute-based rule can be formed on it for decision making in the rule engine.
Operation	matches notmatches equals notequals	Performs the rule based on operation configured on the attribute of a process. Only `matches` and `notmatches` support REGEX. For others, string is used.
REGEX	A regular expression	Includes a regular expression or a string of characters. It describes a grammar that can be constructed based on ECMA script.
STRING	Any characters	Defines a string of characters.

Enter the command with attribute type as parent_process_name, user, or path:

sadmin ruleengine add <ruletype> processname <attributetype> <operation> STRING

This table describes the command's tokens and their functionality.

Token	Possible values	Description
Ruletype	allow block monitor	Allows you to create a rule to allow, block or monitor execution.
Attributetype	user parent_process_name path	Defines the attribute type on which attribute-based rules can be formed for decision making in the rule engine.
Operation	equals notequals	Performs the rule based on operation configured on the attribute of a process.
STRING	Any characters	Defines a string of characters.

You can use multiple attributes when creating attribute-based rules. Use AND as a connector while creating a rule based on two or more attribute types. For example, sadmin ruleengine add block powershell.exe command_line matches .*iex* AND user equals "user1" rule prevents user1 from running powershell.exe when run with command-line argument that matches regex .*iex* in this case. In other scenarios, user1 is allowed to execute powershell.exe.