Endpoint Administration Guide for Windows › Monitoring and Auditing › Events Interception

Events Interception

CA Access Control intercepts an event if the following two conditions are met:

• The appropriate class is active.
• A rule anticipating this event exists in the database.

For example, you can use the following generic rule to audit all file accesses to files that reside in c:\data\payroll:

newres FILE c:\data\payroll\*

You also need to make sure that the FILE class is active (the default).