Allow for "OR" logic in rule creation
M
Matthew Buehlmann
The ability to create "OR" logic in rules would allow for better rule management of complex systems and processes.
Especially for certificate-based rules, to structure rules with and/or functionality would allow for rule consolidation. For Example, the following rule would cover all installation components that may otherwise take 2-3 separate rules:
Cert = XYZ Company
AND
Product Name = XYZ Installation Services
OR
File Name = setup.exe
OR
File Name = drivers.dll
D
Daniel Rivera
Hi Matthew — thanks for writing this up, and the example is a helpful one.
This is already on our radar: we have an open request with our product team for an AND/OR option on rule identification criteria, so a rule can match on any one of several criteria rather than requiring all of them. It came to us from the deny side originally — a partner wanting a block rule that couldn't be sidestepped by a changed filename or hash — so your approve-side consolidation case is a useful addition to it, and I'll pass it along.
No timeline to share yet as it's still in discovery, but we'll post updates here as it moves. In the meantime, if there are particular rule sets where the multiple-rule workaround is causing the most overhead, let us know — that helps us size the impact.
M
Matthew Buehlmann
Daniel Rivera - Hey Daniel, thanks for the response. This came up again today working with a common accounting software platform. The use case here is that the software operates in both C:\Program Files (x86) and C:\Programdata directories.
In this use case putting both of the directories as "OR" operators, combined with the signing cert, would allow me to consolidate two rules to one.
Just tossing out another example for you, thanks for fielding the requests!
D
Daniel Rivera
Matthew Buehlmann: Thanks Matthew — that's a useful one, and a cleaner illustration than the original: same signing cert, two install paths, two rules today where one would do. It's captured on the request alongside your first example. Keep them coming.