[Working with conditions in rules - XDR/EDR]

Could you give me an advice?

[Working with conditions in rules - XDR/EDR]

Dear Team, 

I trying to work with an API to automate creating rules based on the data from our CTI solution.

There is any best practice with conditions in XDR rules like limiting the condition or how many conditions in one rule is the best for the production environment with 5000 computer and server

[Detect user install new application]

@Jamil-soc I have the same question, how we can detect if user install the application name "UltraViewer_setup_6.5_vi.exe"