Proactive Defense
121
Take these steps in the window that opens:
1. Enter the name of the new file group for monitoring system registry keys
in the
Group name
field.
2. Select the
Keys
tab, and create a list of registry files that will be in-
cluded in the monitored group (see 10.3.1 on pg. 121) for which you
want to create rules. This could be one or several keys.
3. Select the
Rules
tab, and create a rule for files (see 10.3.2 on pg. 122)
that will apply to the keys selected on the Keys tab. You can create
several rules and set the order in which they are applied.
10.3.1.
Selecting registry keys for creating
a rule
The file group created should contain at least one system registry file. The
Keys
tab provides a list of files for the rule.
To add a system registry file:
1. Click on the
Add
button in the
Edit group
window (see Figure 41).
2. In the window that opens, select the registry file, or folder of files, for
which you want to create the monitoring rule.
3. Specify an object value or mask for the group of objects, to which you
want the rule to apply in the
Value
field.
4. Check
Including subkeys
for the rule to apply to all files attached to
the listed registry file.
You only need to use masks with an asterisk and a question mark at the same
time as the
Include subkeys
feature if the wildcards are used in the name of the
key.
If you select a folder of registry files using a mask and specify a specific value for
it, the rule will be applied to that value for any key in the group selected.
