The user interface for expert rules differs from that of standard rules due to expert rules offering more options. Instead of menus, you can configure expert rules through check boxes.

Procedure

  1. To open the Expert Rules interface for memory or registry rules, follow the steps.
    1. On the Memory or Registry Rules table page, click the Add Memory Rule or Add Registry Rule button.
    2. On the Add Memory Rule or Add Registry Rule page, navigate to the Definition > Expert Mode option and click the On radio button.
      The Location of the On radio button for enabling the expert mode interface for memory rules
  2. To open the Expert Rules interface for custom rules, follow the steps.
    1. On the Custom Rules table page, click the Add Custom Rule button.
    2. On the Add Custom Rule page, navigate to Definition > Rule Type menu, and select Expert.
      The location of the Expert option for enabling the expert interface for custom rules