Click Add Match Criteria to
open the HIP Objects/Profiles Builder. Select the first HIP
object or profile you want to use as match criteria and then add
(
) it to the Match text
box on the HIP Objects/Profiles Builder dialog. Keep in mind that
if you want the HIP profile to evaluate the object as a match only
when the criteria in the object is not true for a flow, select NOT before
adding the object. Continue adding match criteria as appropriate
for the profile you are building, and ensure you select the appropriate
Boolean operator (AND or OR)
between each addition (and using the NOT operator
when appropriate). To create a complex Boolean expression,
you must manually add the parenthesis in the proper places in the Match text
box to ensure that the HIP profile is evaluated using the intended
logic. For example, the following expression indicates that the
HIP profile will match traffic from a host that has either FileVault
disk encryption (Mac OS systems) or TrueCrypt disk encryption (Windows
systems) and also belongs to the required Domain and has a
Symantec antivirus client installed: ((“MacOS” and “FileVault”) or (“Windows” and “TrueCrypt”)) and “Domain” and “SymantecAV” When
you have finished adding the objects and profiles to the new HIP
profile, click OK. |