Regardless of whether you create a monitoring policy or define a monitoring rule group, the framework available to define monitoring rules is the same.
These considerations apply to path-based rules.
- Paths must be absolute when specifying rules to monitor files and directories.
- Paths aren't required to be absolute when specifying rules to monitor program activity. You can specify the partial path or fully qualified path. If you specify the partial path, all programs with names that match the specified string are monitored. If you specify the fully qualified path, activity is monitored for only the specified program.
- Paths can contain white spaces.
- Paths can include the wildcard character (*). But, it can only represent one complete path component. Here are a few examples.
- Using /abc/*/def is allowed while /abc/*.sh, /abc/*.*, or /abc/doc.* are not supported.
Note
You can't use the wildcard character while defining a rule to track content and attribute changes for a file.