Create monitoring policies

You can control monitoring of files, directories, file types (based on file extension), programs, and users.

To create a monitoring policy, you can define rules in a rule group and add the rule group to a policy. You can also define the rules directly in a policy. You can also assign multiple policies to one node in the System Tree.

1. On the Trellix ePO - On-prem console, select Menu → Policy → Policy Catalog.
2. Select the Solidcore 8.x.x: Integrity Monitor product.
3. Click New Policy to open the Create a new policy dialog box and select the category.
4. Select Blank Template from Create a policy based on this existing policy list to define a policy from scratch, specify the policy name, then click OK.
5. Click the policy name to open the Policy Settings page.
6. Add a rule group to the policy.
   1. Click Add in the Rule Groups pane to open the Select Rule Groups dialog box.
   2. Select the rule group to add.
   3. Click OK.
   4. Select the rule group in the Rule Groups pane.
      The rules included in the rule group are displayed in the various tabs.
   5. Review the rules.
7. Add the monitoring rules to the policy, then save the policy.