Subrule parameters

--addsubrule

This command is used to add subrules to a rule.

--editaprule [ruleindex]

Edits a custom Access protection rule identified by ruleindex.

--subrulename [value]

This command is used to name the subrule that is added to the rule. The subrule name must be unique within a rule. This parameter is mandatory.

--subruletype [file | process]

This command is used to set the type of subrule. The type can be file or process. This parameter is mandatory.

--operations [value(s)]

This command is used to specify the operations associated with the subrule. Operations can vary based on the type of the subrule.

Possible values for file subrule — create, delete, execute, change permission, read, rename, write, change owner, symlink, and hardlink.

Possible values for process subrule — terminate and run.

This parameter is mandatory. Single or comma-separated values are allowed.