Use special XML-based language to define multiple folders in one (1) IM rule. To do this:
- Log on to the Deep Security web console.
- Go to Policies > Common Objects > Rules > Integrity Monitoring Rules.
- Select New Integrity Monitoring Rule.
Example of XML-based language:
To monitor all the .exe and .dll files from the C:\Program Files\ folder and all sub-folders, use the following:
<FileSet base="C:\Program Files\">
<include key="**/*.exe"/>
<include key="**/*.dll"/>
</FileSet>
<include key="**/*.exe"/>
<include key="**/*.dll"/>
</FileSet>
To monitor all files from the C:\Windows folder excluding its subfolders, use the following:
<FileSet base="C:\Windows\">
<include key="*"/>
</FileSet>
To monitor all files from the C:\Windows folder including its subfolders, but exclude specific subfolders under the same directory, use the following:
<FileSet base="C:\Windows\">
<include key="**/*"/>
<exclude key="**/Windows/Temp/**"/>
<exclude key="**/Windows/Log/**"/>
</FileSet>
<include key="*"/>
</FileSet>
To monitor all files from the C:\Windows folder including its subfolders, but exclude specific subfolders under the same directory, use the following:
<FileSet base="C:\Windows\">
<include key="**/*"/>
<exclude key="**/Windows/Temp/**"/>
<exclude key="**/Windows/Log/**"/>
</FileSet>
For more information about Integrity Monitoring Rules Language, refer to page 871 of the Deep Security 20.0 Administrator’s Guide .