Application Discovery 7.2 User Guide

Aggregation rule fields and their descriptions
DescriptionField
Rules can be simple or complex, and are based on types that can be added to or deleted from the
rule. Possible type values used to construct a rule include:
• Or
Can contain a list of one or more And, Or, User, Group, Path or Cmdline values.
Effect: Any one of the rules within this statement can be true to match a process to the application.
• And
Can contain a list of one or more And, Or, User, Group, Path or Cmdline values.
Effect: All of the rules within this statement must be true to match a process to the application.
• User
Supply the user name associated with the process. In addition to literal names, regular expressions
are allowed.
Effect: Make matching to a process dependent on a particular user.
• Group
Supply the group name of the process. Regular expressions are allowed.
Effect: Make matching to a process dependent on a particular group.
• Path
Supply the executable path of the process. Regular expressions are allowed.
Effect: Make matching to a process dependent on a particular executable path.
• Cmdline
Supply the command line arguments used to start the process. Regular expressions are allowed.
Effect: Make matching to a process dependent on a particular command line argument.
Rule
NOTE: If you want to define your application based on specific ownership, path, or command
line arguments, you can check the “Unmatched processes” table on a particular host screen or the
“Processes not matched by this template” table on a template editing screen to get this information.
See Filling in aggregation rule fields using table data for tips on finding specific process attributes
for this purpose.
For an example of how to build an application template rule for aggregating processes into an
application, see “Create a process aggregation rule” (page 30).
Create an application template rule
Application Discovery provides a set of options and fields that help you to define a valid application
template rule. The rule you create governs discovery of the application that you have defined. You
can create rules that apply generally or specifically to a process, user, or group.
Create a process aggregation rule
An aggregation rule is one in which you designate one or more characteristics in order to collect
the associated process or processes into an application that can be matched by Application
Discovery.
The following procedure assumes that you have opened an application template and are ready
to edit the Aggregation Rules form.
30 Procedures and examples