Specifications

Use Templates to Define Rules
To create an event specification based on an event
1. In the rules pane, place the cursor where you want the new event
specification to appear in the rule set.
2. In the events pane, select the event that you want to use as a basis for
the new event specification.
3. Right-click the event and select Create Event from the shortcut menu.
In the rules pane, BT Studio adds an event specification based on
information from the selected event, similar to the following:
Event "<EventName>" Process Start { ExecutableName="winlogon" }
4. In the rules pane, edit the event specification to replace <EventName>
with an event name that you assign. For example:
Event "WindowsLogin" Process Start { ExecutableName="winlogon" }
5. Continue defining other event specifications and transaction definitions, as
appropriate.
6. Before exiting BT Studio, be sure to test the rules and save your changes.
Use Templates to Define Rules
You can use templates to help define the following parts of a rule set:

Transaction definition

Event specification

Alternate rule set
To use a template to define rules
1. In the rules pane of BT Studio, place the cursor at the point where you
want to add a rule.
2. Right-click and from the shortcut menu select Insert Template, then select
the appropriate option:
 Transaction to insert a transaction definition template.
 Event to insert an event specification template.
 Alternate Ruleset to insert a template for an alternate rule set.
BT Studio inserts text into the rules pane for the selected template.
Keywords appear in blue text; text that you must replace appears
enclosed within square brackets [ ].
3. Replace the text in square brackets with the indicated information.
Print a Rule Set
62 BTStudio Administration Guide