> For the complete documentation index, see [llms.txt](https://docs.enginsight.com/docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.enginsight.com/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/rules/add-rule.md). # Add Rule Click **Create Rule** in the upper-right corner of the [rule overview](/docs/manual/english/platform-usage/hosts/file-integrity-monitoring/rules.md#rules-overview) to create a new rule. The **Hosts** → **File Integrity Monitoring** → **Rules** → **Add** view opens.

After configuring all settings, click **Create Rule** to save and create the new rule. Click **Back** to return to the overview. {% hint style="danger" %} **Please note:** If you leave this view without clicking **Create Rule**, all configured settings will be permanently lost. {% endhint %} *** ## General Settings Here you can configure various basic settings.

The following options are available:

Option	Description
Name	Enter a meaningful name for the rule.
Description	Provide a more detailed description for the rule. This field is optional.
Severity	Define a severity level for the rule. The default severity level is High. Click the Severity field to expand a list of all available severity levels, then select a severity level. The following severity levels are available: Critical: The rule has a very high criticality. High: The rule has a high criticality. Medium: The rule has a medium criticality. Low: The rule has a low criticality.
Operations	Define the file operations to which the rule applies. Click the Operations field to expand a list of all available file operations, then select one or more file operations. Click a selected file operation again to remove it from the Operations field. The following file operations are available: Alter: File metadata, such as access permissions or ownership, is modified. Change: The file content is modified. Create: A new file is created. Delete: The file is deleted. Read: The file is read.
Enabled	Enable the rule to monitor files and directories. This option is enabled by default. Select or deselect the checkbox next to Enabled to enable or disable the rule.

## Assigned References Here you can define the hosts or groups of hosts to which the configured settings should apply.

The following options are available:

Option	Description
Hosts	Define the hosts to which the configured settings should apply. Click the Hosts field to expand a list of all available hosts, then select one or more hosts. Alternatively, use the free-text search to find hosts in the list more quickly. Click the Remove icon next to an added host to remove it from the Hosts field.
Tag Logic	Define how many tags an assigned host must have for the settings to apply to it. The default tag logic is All Tags are Present in the Reference. Click the Tag Logic field to expand a list of all available options. The following options are available: All Tags are Present in the Reference: An assigned host must have all specified tags for the settings to apply to it. At Least One of the Specified Tags is Present: An assigned host must have at least one of the specified tags for the settings to apply to it.
Tags	Define tags for groups of hosts to which the configured settings should apply. Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text search to find tags in the list more quickly. Click the Remove icon next to an added tag to remove it from the Tags field.

Option

Description

Hosts

Define the hosts to which the configured settings should apply.

Click the Hosts field to expand a list of all available hosts, then select one or more hosts. Alternatively, use the free-text search to find hosts in the list more quickly.

Click the Remove icon next to an added host to remove it from the Hosts field.

Tag Logic

Define how many tags an assigned host must have for the settings to apply to it.

The default tag logic is All Tags are Present in the Reference.

Click the Tag Logic field to expand a list of all available options.

The following options are available:

All Tags are Present in the Reference: An assigned host must have all specified tags for the settings to apply to it.
At Least One of the Specified Tags is Present: An assigned host must have at least one of the specified tags for the settings to apply to it.

Tags

Define tags for groups of hosts to which the configured settings should apply.

Click the Tags field to expand a list of all available tags, then select one or more tags. Alternatively, use the free-text search to find tags in the list more quickly.

Click the Remove icon next to an added tag to remove it from the Tags field.

### Excluded References Here you can define which hosts or groups of hosts should be explicitly excluded from the configured settings. {% hint style="info" %} Defining excluded hosts is optional. {% endhint %} Click **Define Exceptions** next to **Assigned Hosts** to show the options for **Excluded Hosts**.

Configure all settings as described for an assigned host. *** ## File Paths Here you can define file paths that should be monitored or excluded from monitoring.

The following options are available:

Option	Description
File Path	Enter a file path that should be monitored. You can use wildcards (*) here.
Add Field	Click Add Field to add the file path to the rule and show another field in which you can enter an additional file path.
Delete	Click the Delete icon next to an added file path to remove the respective path from the rule.

### File Path Exceptions Here you can define file paths that should be excluded from monitoring. {% hint style="info" %} Specifying file path exceptions is optional. {% endhint %} Click **Add Field** to add a field in which you can enter a file path.

Configure all settings in the same way as for a file path that should be monitored. ***