Each target is added with an Include or Exclude directive.
.png)
When evaluating a system event against a subrule, the subrule evaluates to true if:
At least one Include evaluates to true.
and
All Excludes evaluate to false.
Exclude takes precedence over Include. Here are examples:
If a single subrule both includes and excludes a file C:\marketing\jjohns, the subrule does not trigger for that file.
If a subrule includes all files but excludes the file C:\marketing\jjohns, the subrule triggers if the file is not C:\marketing\jjohns.
If a subrule includes file C:\marketing\* but excludes C:\marketing\jjohns, the subrule triggers for C:\marketing\anyone, but doesn't trigger for C:\marketing\jjohns.