Use this file to discover all available pages before exploring further.
The new docs.trellix.com features a modernized UI and AI-powered conversational search. Content is currently available in English, with additional languages launching in early November 2026. We hope you enjoy the updated experience.
When you create a rule, use parameters to block enable/disable, to apply the rule to specific users, files, or processes. You can also use parameters to report the number of tries made to access the rule-enabled files. You can also edit any rule using rule index. The getallaprules command lists all access protection rules with rule index created for a system.
Access Protection parameters to create rules
Options
Description
--rulename [value]
This command is used to name the Access Protection custom rule. Here, value can be alphanumeric and can take a maximum of 256 characters. Each custom rule name must be unique. When creating a rule, this parameter is mandatory.
--block [enable | disable]
This command is used to enable or disable blocking of access attempts defined in the rule. This parameter is mandatory.
The parameter to enable or disable the block command:--block [enable | disable]
Note
When creating a rule, both --block or --report parameters are mandatory. A rule is disabled when both --block and –report are disabled. If both rules exist, then block is given the higher precedence.
--report [enable | disable]
This command is used to enable or disable reporting of access tries. This parameter is mandatory.
Note
When creating a rule, both --block or --report parameters are mandatory. A rule is disabled when both --block and –report are disabled. If both rules exist, then block is given the higher precedence.
--includeprocess [name1:file1, name2:file2,…]
--excludeprocess [name1:file1, name2:file2,…]
This is an optional parameter and specifies the applicable process that triggers the rule if there is a subrule violation. You can identify a process with a name and a file. File can be either the file name or path. Wildcards [*, ?, and **] and comma-separated values are also accepted.
Note
When --includeprocess and --excludeprocess are not specified, the rule becomes applicable to all processes.
When the same process is mentioned in --includeprocess and --excludeprocess, then --excludeprocess takes higher precedence.
--includeusers [user1, user2,…]
--excludeusers [user1, user2,…]
--includeusers triggers the rule for the specified users when there is a violation, whereas --excludeusers does not trigger the rule even when there is a rule violation. These parameters are optional and can accept comma-separated values. Local and Domain users are supported.
Note
When --includeusers and --excludeusers are not specified, the rule becomes applicable to all users.
When the same user is mentioned in --includeusers and --excludeusers then --excludeusers takes higher precedence.