Aggregation rule fields and their descriptions

Field

Description

 

 

Rule

Rules can be simple or complex, and are based on types that can be added to or deleted from the

 

rule. Possible type values used to construct a rule include:

 

•

Or

 

 

Can contain a list of one or more And, Or, User, Group, Path or Cmdline values.

 

 

Effect: Any one of the rules within this statement can be true to match a process to the application.

 

•

And

 

 

Can contain a list of one or more And, Or, User, Group, Path or Cmdline values.

 

 

Effect: All of the rules within this statement must be true to match a process to the application.

 

•

User

 

 

Supply the user name associated with the process. In addition to literal names, regular expressions

 

 

are allowed.

 

 

Effect: Make matching to a process dependent on a particular user.

 

•

Group

 

 

Supply the group name of the process. Regular expressions are allowed.

 

 

Effect: Make matching to a process dependent on a particular group.

 

•

Path

 

 

Supply the executable path of the process. Regular expressions are allowed.

 

 

Effect: Make matching to a process dependent on a particular executable path.

 

•

Cmdline

 

 

Supply the command line arguments used to start the process. Regular expressions are allowed.

 

 

Effect: Make matching to a process dependent on a particular command line argument.

 

 

 

 

 

 

NOTE: If you want to define your application based on specific ownership, path, or command line arguments, you can check the “Unmatched processes” table on a particular host screen or the “Processes not matched by this template” table on a template editing screen to get this information. See Filling in aggregation rule fields using table data for tips on finding specific process attributes for this purpose.

For an example of how to build an application template rule for aggregating processes into an application, see “Create a process aggregation rule” (page 32).

Create an application template rule

Application Discovery provides a set of options and fields that help you to define a valid application template rule. The rule you create governs discovery of the application that you have defined. You can create rules that apply generally or specifically to a process, user, or group.

Create a process aggregation rule

An aggregation rule is one in which you designate one or more characteristics in order to collect the associated process or processes into an application that can be matched by Application Discovery.

The following procedure assumes that you have opened an application template and are ready to edit the Aggregation Rules form.

32 Procedures and examples