About the Integrity Monitoring rules language

Entity Sets

• DirectorySet: rules will scan the integrity of directories
• FileSet: rules will scan the integrity of files
• GroupSet: rules will scan the integrity of groups
• InstalledSoftwareSet: rules will scan the integrity of installed software
• PortSet: rules will scan the integrity of listening ports
• ProcessSet: rules will scan the integrity of processes
• RegistryKeySet: rules will scan registry keys
• RegistryValueSet: rules will scan registry values
• ServiceSet: rules will scan the integrity of services
• UserSet: rules will scan the integrity of users
• WQLSet: rules will monitor the integrity of the results of a Windows Management Instrumentation WQL query statement

Hierarchies and wildcards

• / (forward slash) : demarcates sections of the pattern to be applied to levels of the hierarchy
• ** (two stars) : matches zero or more sections

• ? (question mark) : matches one character
• * (one star) : matches zero or more characters

• \ (back slash) : escapes the next character

• "a?c" matches "abc"
• "123" matches "123"
• "*.java" matches "test.java"

• "a?c" matches "abc"
• "123" does not match "123456", and so no more matching is performed

Syntax and concepts

<FileSet base="C:\Program Files\MySQL">
</FileSet>

Note The " * " and " ? " wildcards can be used in a "base" attribute string, but only in the last path component of the base. So this is valid: <codeblock>base="C:\program files\CompanyName * Web Server" </codeblock> but this is not: <codeblock>base="C:\* files\Microsoft Office"</codeblock>

Note If a path supplied in an include or exclude rule is syntactically invalid, the Agent will generate an "Integrity Monitoring Rule Compile Issue" Agent Event and supply the rule ID and the path (after expansion) as parameters. An example of an invalid path would be C:\test1\D:\test2 since a file name may not contain two volume identifiers.

Include tag

<FileSet base="C:\Program Files\MySQL">
<include key="**/*.exe"/>
</FileSet>

<FileSet base="C:\Program Files\MySQL">
<include key="**/*.exe"/>
<include key="**/*.dll"/>
</FileSet>

<include>
<key pattern="**/*.exe"/>
<key pattern="**/sample*"/>
</include>

<include key="**/*.exe">
<key pattern="**/sample*"/>
</include>

Exclude tag

<FileSet base="C:\Program Files\MySQL">
<include key="**"/>
<exclude key="**/*.tmp"/>
</FileSet>

<FileSet base="C:\Program Files\MySQL">
<include key="**/*.exe"/>
<include key="**/*.dll" />
<exclude key="**/MySQLInstanceConfig.exe"/>
</FileSet>

<exclude>
<key pattern="**/MySQLInstanceConfig*" />
<key pattern="**/*.exe" />
</exclude>

Case sensitivity

• true
• false
• platform

<FileSet base="C:\Program Files\MySQL">
<include key="**/*Sample*"/>
</FileSet>

<FileSet base="C:\Program Files\MySQL">
<include key="**/*Sample*" casesensitive="true"/>
</FileSet>

Note A case sensitive setting of "true" is of limited use on a platform such as Windows which is case insensitive when it comes to most object names.

Entity features

<FileSet base="C:\Program Files\MySQL">
<include key="**" executable="true"/>
</FileSet>

<include executable="true">
<key pattern="**/*MySQL*"/>
</include>

Note Where wildcard matches are supported, it is important to note that the match is against the string value of the attribute and that no normalization takes place. Constructs available for Entity key matches such as "**" and the use of "/" to separate hierarchical components don't apply. Matching a path name on Windows requires the use of "\" since that is the character which appears in the value of the attribute being tested, whereas Unix systems will use "/" in path values so matches against Unix paths need to use "/".

<ServiceSet>
<include state="running"/>
</ServiceSet>

Note Wildcards are not supported in state matches.

<ProcessSet>
<include path="*\notepad.exe"/>
</ProcessSet>

<ProcessSet>
<include commandLine="/sbin/*"/>
</ProcessSet>

Note Be careful when using wildcards. A wildcard expression like "**" will look at every file in every sub directory beneath "base". Creating a baseline for such an expression can take a lot of time and resources.

ANDs and ORs

<include>
<key pattern="**/*MySQL\*" />
<key pattern="**/*.exe"/>
</include>

<include key="**/*.exe">
<key pattern="**/*MySQL*" />
</include>

<include key="**/*.dll" />
<include key="**/*.exe" />

Order of evaluation

Entity attributes

Note If the "attributes" tag is present, but contains no entries, then the Entities defined by the rule are monitored for existence only.

<FileSet base="C:\Program Files\MySQL" >
<include key="**/*SQL*" executable="true"/>
<attributes>
<lastModified/>
<permissions/>
<owner/>
</attributes>
</FileSet>

<FileSet base="C:\Program Files\MySQL" >
<attributes>
<permissions/>
<owner/>
</attributes>   
<include key="**/*.log" />
</FileSet>

<FileSet base="C:\Program Files\MySQL" >
<include key="**/*.log" />
</FileSet>

<FileSet base="C:\Program Files\MySQL" >
<attributes/>
<include key="**/*.log" />
</FileSet>

Shorthand attributes

onChange attribute

<FileSet base="C:\Program Files\MySQL" onChange="true">
<include key="**/*.exe"/>
<include key="**/*.dll" />
</FileSet>

Environment variables

Note The values of referenced environment variables are read and stored by the agent on agent startup. If the value of an environment variable changes, the Agent must be restarted to register the change.

Environment variable overrides

Note Environment variables are used primarily by the virtual appliance when performing agentless Integrity Monitoring on a virtual machine. This is because the virtual appliance has no way of knowing if the operating system on a particular virtual machine is using standard directory locations.

1. Open the Computer or Policy editor where you want to override an environment variable.
2. Click Settings → Advanced.
3. In the Environment Variable Overrides section, click View Environment Variables to display the Environment Variable Overrides page.
4. Click New in the menu bar and enter a new name-value pair (for example, WINDIR and D:\Windows) and click OK.

Registry values

Note A wildcard is allowed only in the last hierarchical component of a base name. For example, "base="HKLM\Software\ATI*" is valid and will find both "HKLM\Software\ATI" and "HKLM\Software\ATI Technologies"; however, base="HKLM\*\Software\ATI* is invalid.

Use of ".."

<FileSet base="${env.USERPROFILE}\..">
<include key="*/Start Menu/Programs/Startup/*"/>
</FileSet>

Best practices

• Use "**/..." from a top-level of the hierarchy such as "/", "C:\", or "HKLM\Software".
• Use more than one content hash type unless absolutely necessary.
• Reference user-specific locations such as HKEY_CURRENT_USER, ${env.USERPROFILE}, or ${env.HOME}.