The sensor is configured to delete the directory "C:\Windows\Temp" if its size exceeds 500 MB:
The configuration of the sensor looks as follows:
Folder Settings
Path |
The path to the directory which should be monitored. In this case 'C:\Windows\Temp'. |
Credential |
The credential which is needed to authenticate on the host. |
Conditions
Condition |
The action 'Cleanup C:\' will be executed, if the size returned by the sensor exceeds '500MB'. |
The action to perform a cleanup is a "Process/Script Execution" action which is configured as follows:
Host Settings
Host |
The host on which the content of 'C:\Windows\Temp' should be deleted. |
Credential |
The credential which is needed to authenticate on the host. |
Process/Script Settings
File Path |
The path to the file which should be executed. In this case 'cmd.exe'. |
Arguments |
The arguments which are passed to the 'cmd.exe'. In this case: /C rmdir /s /q C:\Windows\Temp |
Working Directory |
The path to the directory on which the .exe file is working. In this case the 'C:\' partition. |
