The advanced rule enables users to create powerful rules using RulePoint’s Detect and Respond Query Language (DRQL).
Only users experienced with DRQL should manually create rules in the advanced mode. All other users should use the rule wizard or a template. You can use the DRQL samples provided with the installation package.
It is recommended that you always use white space before and after keywords in Advanced rules. While not having white space(s) might not cause a syntax error on save; during runtime, rules with keywords that do not have leading and trailing white spaces can cause display errors in the user interface. Rules created in advanced mode cannot be edited using the rule wizard.