Custom Policy Folder

System Monitor 7.17 includes a new custompolicies folder inside the policies folder. The file path for the folder is C:\Program Files\LogRhythm\LogRhythm System Monitor\policies\custompolicies.

You can add custom policy files to this folder, including those you created with the JSON Policy Builder, which will be used by the System Monitor Agent JSON parser to parse the data. The policy files in the custompolicies folder will never be overwritten or lost during a System Monitor upgrade.

If you make any changes to LogRhythm defined policies, like adding a custom rule or modifying an existing rule, you should copy that file to the custompolicies folder to avoid losing those changes in during an upgrade.

Load Custom Policies to Parse JSON Data

You must load your custom policies for the System Monitor Agent JSON parser to use them.

To load your custom policies:

1. Copy the policy file to the custompolicies folder.

2. Restart the System Monitor Service. This step will read the new custom policy file and load it for parsing.

The policies in your custompolicies folder will always take priority over LogRhythm defined policies when parsing data. For example, if you make changes to parsing rules in the LogRhythm defined Okta policy and load the updated policy, then the Okta JSON will always be parsed according to the Okta rules defined in the custompolicies folder.