Attribute-based rules provide flexibility to allow or block file execution, as needed.
On the Rule Groups tab, locate your Group Name and under Actions, click Edit.
On the Execution Control tab, click Add.
To define an attribute-based rule for a file, select Based on specified attributes.
Select the type of rule to define: Allow, Block, or Monitor.
Specify the file name.
Specify the attributes to define the rule.
You can use one or all attributes to define the rule. Available attributes are path, command line, parent process, and user. You can use the AND operator to combine rules based on different attributes.
Select the checkbox associated with the attribute.
Select the operator for the attribute.
Enter the string.
(Optional) Enter the rule description.
Click OK.