Match command

The Match command defines the criteria that AAC uses to match an event.

Note

Exploit Prevention is not supported in the ARM architecture.

Description

This command takes one required argument, object_type_value, which specifies the case-sensitive AAC object type to match, and can contain multiple Include and Exclude commands.

The Match command can be used in Initiator and Target commands only.

Important

It is recommended to use a single Match type - Object type. When using two or more of the same Match type - Object type, it can lead to logic conflicts and will not work as expected if the rule contains logical contradictions. If use of a second Match type - Object type is required, the recommendation is to use a different Object type. For example, if the first Match type is OBJECT_NAME, then the second should use a different Object type like TARGET_OBJECT_NAME.

Syntax

Rule	{
	Initiator
			Match object_type_value { 
				Include …
				Exclude …
			}
	}
	Target
			Match object_type_value { 
				Include …
				Exclude …
			}
	}
}