The AggregateMatch command defines a list of data that AAC uses to match an event. You can use this command to create a list of values to match in a rule so you can use the same data without having to rewrite the values.
Note
Exploit Prevention is not supported in the ARM architecture.
Description
This command takes no arguments and can be used in Include and Exclude commands only.
The Match_type value is required for each item in AggregateMatch.
Syntax
Rule {
Initiator {
Match object_type_value {
Include AggregateMatch {
Include ...
Exclude ...
}
Exclude AggregateMatch {
Include ...
Exclude ...
}
}
}
...
Target {
Match object_type_value {
Include AggregateMatch {
Include ...
Exclude ...
}
Exclude AggregateMatch {
Include ...
Exclude ...
}
}
}
...
}