Framework to define monitoring rules

Regardless of whether you create a monitoring policy or define a monitoring rule group, the framework available to define monitoring rules is the same.

System variables

The path specified in a monitoring rule can include system environment variables. This table lists the supported system variables.

Variable	Example value (for most Windows platforms)
`%ALLUSERSPROFILE%`	`C:\ProgramData` `C:\Documents and Settings\All Users` (in earlier Windows versions)
`%APPDATA%`	`C:\Users\(username)\AppData\Roaming` `C:\Documents and Settings\{username}\Application` (in earlier Windows versions)
`%COMMONPROGRAMFILES%`	`C:\Program Files\Common Files`
`%COMMONPROGRAMFILES (x86)%`	`C:\Program Files (x86)\Common Files`
`%HOMEDRIVE%`	`C:`
`%HOMEPATH%`	`C:\Users\(username)` `C:\Documents and Settings\{username}` or `\` (in earlier Windows versions)
`%PROGRAMFILES%`	`C:\Program Files`
`%PROGRAMFILES (x86)%`	`C:\Program Files (x86)` (only in 64-bit versions)
`%SYSTEMDRIVE%`	`C:`
`%SYSTEMROOT%`	`C:\Windows` (`C:\WINNT` in earlier Windows versions)
`%TEMP% (system) %tmp% (user)`	`C:\Users\(username)\AppData\Local\Temp` `C:\Documents and Settings\{username}\local Settings\Temp` (in earlier Windows versions) `C:\Temp` (in earlier Windows versions)
`%USERPROFILE%`	`C:\Users\(username)` `C:\Documents and Settings\{username}` (in earlier Windows versions) `C:WINNT\profiles\{username}`(in earlier Windows versions)
`%WINDIR%`	`C:\Windows`

These considerations apply to path-based rules.

Paths must be absolute when specifying rules to monitor files and directories.
Paths aren't required to be absolute when specifying rules to monitor program activity. You can specify the partial path, such as AcroRd32.exe or Reader\AcroRd32.exe or fully qualified path, such as C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32.exe . If you specify the partial path, all programs with names that match the specified string are monitored. If you specify the fully qualified path, activity is monitored for only the specified program.
Paths can contain white spaces.
Paths can include the wildcard character (*). But, it can only represent one complete path component. Here are a few examples.
- Using \abc\*\def is allowed while \abc\*.doc, \abc\*.*, or \abc\doc.* are not supported.
Note
You can't use the wildcard character while defining a rule to track content and attribute changes for a file.
Paths used in registry key-based rules can include the wildcard character (*). But, the wildcard character can only represent one path component in the registry path. Make sure that you don't use the character for the component at the end of the complete registry path.
Also, at any time, the CurrentControlSet in the Windows Registry is linked to the relevant HKEY_LOCAL_MACHINE\SYSTEM\ControlSetXXX key. For example, the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet can be linked to HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001 key. When a change is made to either link, it is automatically updated on both links. For a monitored key, events are always reported with the path of CurrentControlSet and not ControlSetXXX.