How match criteria in AAC-based subrules are evaluated

The match criteria in each subrule specifies either the Include or Exclude directive. The rule engine evaluates the filtered event against the match criteria in the subrule.

Note
Exploit Prevention is not supported in the ARM architecture.

The subrule matches the filtered event if both of the following are true:

At least one Initiator subrule matches the process that initiated the action described by the event.
At least one Target subrule matches the object type that is the subject of the action.

When evaluating a filtered event against a subrule, the rule engine performs logical OR between matching criteria of the same type and logical AND between matches of different type. The rule engine first evaluates the matches with the Exclude directive, and then evaluates the matches with the Include directive.

The subrule evaluates to TRUE if both of the following are true:

Exclude matches evaluate to FALSE.
Include matches evaluate to TRUE.

Example

Rule {
	Initiator {
		Match PROCESS { 
				Include OBJECT_TYPE_A      { … }
				Include OBJECT_TYPE_B      { condition 1 }
				Include OBJECT_TYPE_B      { condition 2 }
				Exclude OBJECT_TYPE_C      { … }
			}
		Target {
			Include OBJECT_TYPE_D     { condition 1 }
			Include OBJECT_TYPE_D     { condition 2 }
		}
}

This rule evaluates to TRUE if both the following are TRUE:

One of the following Initiator conditions is TRUE:
- OBJECT_TYPE_A and OBJECT_TYPE_B condition 1 are TRUE.
- OBJECT_TYPE_A and OBJECT_TYPE_B condition 2 are TRUE.
- OBJECT_TYPE_A is TRUE and OBJECT_TYPE_C is FALSE.
One of the following Target conditions is TRUE:
- OBJECT_TYPE_D condition 1 is TRUE.
- OBJECT_TYPE_D condition 2 is TRUE.