This example log shows some of the possible cause of errors while writing Expert Rules. Trellix Endpoint Security (ENS) provides information in the EndpointSecurityPlatform_Errors.log file about rules that didn't successfully compile and so were not enforced.
Because all Expert Rules are compiled into a single group, when an Expert Rule generates an error, no Expert Rules are enforced.
Note
Exploit Prevention is not supported in the ARM architecture.
Tip
Best practice: To isolate any potential issues, every time you create a rule, verify that it was successfully enforced on the client system.
The EndpointSecurityPlatform_Errors.log file includes detailed information, such as the content of the rule and the parameter that caused the error. For example, this log error shows the Expert Rules error, which is an extra Include command:
08/11/2017 11:57:34.403 AM mfeesp(4016.4412) <SYSTEM> ApBl.AP.Error: Syntax error: Include: Invalid number of arguments
while executing
"Include Include OBJECT_NAME { -v "*PowerShell*" }"
Include Include OBJECT_NAME { -v "*PowerShell*" }
Include PROCESS_CMD_LINE { -v "*-extoff* script.scp" }
Include ..."
invoked from within
"Process {
Include OBJECT_NAME { -v "*PowerShell*" }
Include PROCESS_CMD_LINE { -v "*-extoff*" }
Include PROCE ..."
invoked from within
"Rule -id "4100" {
Reaction BLOCK
Group "ExPExpertRules"
Description "testrule"
Process {
Include AggregateMatch {
Include OBJECT_NAME { ..."
invoked from within
"Policy {
Rule -id "4100" {
Reaction BLOCK
Group "ExPExpertRules"
Description "testrule"
Process {
Include AggregateMatch {
Include OBJECT_NA ..."LastErr 0x000010dd The operation identifier is not valid.
08/11/2017 11:57:34.403 AM mfeesp(4016.4412) <SYSTEM> ApBl.AP.Error: ERR: BLError 0xc0380102, Could not process content file