Track content changes

When you create or change a monitoring (Integrity Monitor) policy or rule group, you can specify the files for which to track content changes.

1. Navigate to the File tab.
2. Perform one of these steps.
   • Click Add to monitor and track changes for a new file.
   • Select an existing rule and click Edit.
3. Review or add the file information.
4. Select Enable Content Change Tracking.
5. Select the file encoding.
   You can choose Auto Detect, ASCII, UTF-8, and UTF-16. Auto Detect works for most files. If you are aware of the file encoding, select ASCII, UTF-8, or UTF-16 (as appropriate). If needed, you can add new file encoding values. Contact Trellix Support for assistance in adding a file encoding value.
6. Track content changes for files in a directory.
   1. Select Is Directory.
   2. Select Recurse Directory to track changes for files in all subdirectories of the specified directory.
   3. (Optional) Specify patterns to match file names in the Include Patterns or Exclude Patterns. While specifying multiple patterns, make sure that each pattern is on a separate line.
      If you do not specify a pattern, all files are included for change tracking. You can add an asterisk (*) at the beginning or end of a pattern. If you specify *.txt as an include pattern, only txt files in the directory are monitored. If you specify *.ini as an exclude pattern, all ini files in the directory are not monitored. Also, while specifying multiple patterns, make sure that each pattern is on a separate line. For example:

      *.log

      Test.txt

      Test*

      If you erroneously add *.log and Test.txt in one line, the software considers it as a single pattern and matches accordingly.

      Note

      Exclude patterns take precedence over include patterns. For example, if you erroneously define an include and exclude pattern for the same file, the exclude pattern applies.

7. Click OK.