Ted Join

Could you give me an advice?

Dear Team, I trying to work with an API to automate creating rules based on the data from our CTI solution. There is any best practice with conditions in XDR rules like limiting the condition or how many conditions in one rule is the best for the production environment with 5000 computer and server

@Jamil-soc I have the same question, how we can detect if user install the application name "UltraViewer_setup_6.5_vi.exe"