Remove attribute-based rule

You can remove attribute-based rules defined on the system.

Remove one rule with attribute type as command_line:

sadmin ruleengine remove <ruletype> processname command_line <operation> <REGEX/STRING>

This table describes the command's tokens and their functionality in detail.

Token	Possible values	Description
Ruletype	allow block monitor	Allows you to create a rule to allow, block, or monitor execution.
Attributetype	command_line	Defines the `command_line` argument with which a process is started. The attribute-based rule can be formed on it for decision making in the rule engine.
Operation	matches notmatches equals notequals	Performs the rule based on operation configured on the attribute of a process. Only `matches` and `notmatches` support REGEX. For others, string is used.
REGEX	A regular expression	Includes a regular expression or a string of characters. It describes a grammar that can be constructed based on ECMA script. See this article for more details.
STRING	Any characters	Defines a string of characters.

Remove one rule with parent_process_name, path, or user attribute type:

sadmin ruleengine remove <ruletype> processname <attributetype> <operation> STRING

This table describes the command's tokens and their functionality.

Token	Possible values	Description
Ruletype	allow block monitor	Allows you to create a rule to allow, block, or monitor execution.
Attributetype	user parent_process_name path	Defines the attribute type on which attribute-based rules can be formed for decision making in the rule engine.
Operation	equals notequals	Performs the rule based on operation configured on the attribute of a process.
STRING	Any characters	Defines a string of characters.

You can use multiple attributes when creating attribute-based rules. Use

AND

as a connector while creating a rule based on two or more attribute types. For example,

sadmin ruleengine remove block powershell.exe command_line matches .*iex* AND user equals "user1"

rule removes the rule that is preventing user1 from running

powershell.exe

when run with command-line argument that matches regex.

*iex*

in this case.

Remove or flush all attribute-based rules defined on the system:
- sadmin ruleengine flush