Using the Include and Exclude keywords

When you select a section value as Include, the section works on the value indicated. When you select a section value as Exclude, the section works on all values except the one indicated.

Note

Exploit Prevention is not supported in the ARM architecture.

The keywords Include and Exclude are supported for all sections except directives and attributes.

Enclose the Include and Exclude keywords in brackets { ... }.

Note

For a standard subrule, use a single backslash in file paths. The standard subrule translates the single slashes to required double slashes. For a subrule in an Expert Rule, use double backslashes in file paths. The expert subrule performs no translation.

For example, to monitor all text files in C:\test\:

files { Include C:\\test\\*.txt }

To monitor all files except the text files in C:\test\:

files { Exclude C:\\test\\*.txt }

Combine keywords to exclude values from a set of included values.

For example, to monitor all text files in folder C:\test\ except file abc.txt:

files { Include C:\\test\\*.txt }
files { Exclude C:\\test\\abc.txt }

Each time you add the same section with the same keyword, you add an operation.

For example, to monitor any text file in folder C:\test\ whose name starts with the string “abc”:

files { Include C:\\test\\*.txt }	
files { Include C:\\test\\abc* }

Exclude takes precedence over Include. For example: