filter_rule_notify_flags Property
Which notification events the rule causes the class to fire.
Syntax
def get_filter_rule_notify_flags(filter_rule_index: int) -> int: ...
Default Value
0
Remarks
Which notification events the rule causes the class to fire.
This property indicates which filesystem operations, of those performed on matching files and directories, the class should fire Notification Events for. The value of this property is a combination of zero or more of the following:
FS_NE_NONE | 0 | Don't fire for any filesystem operations.
Notification Events will not fire for any filesystem operations. |
FS_NE_CREATE | 0x00000001L | Fire for file creation operations.
The on_notify_create_file event will fire anytime the OS creates a file or directory. In some cases, can cause the on_notify_open_file event to fire; refer to the File Create/Open Events topic for more information. |
FS_NE_OPEN | 0x00000002L | Fire for file open operations.
The on_notify_open_file event will fire anytime the OS opens a file or directory. In some cases, can cause the on_notify_create_file event to fire; refer to the File Create/Open Events topic for more information. |
FS_NE_READ | 0x00000004L | Fire for read operations.
The on_notify_read_file event will fire anytime the OS reads data from a file. |
FS_NE_WRITE | 0x00000008L | Fire for write operations.
The on_notify_write_file event will fire anytime the OS write data to a file. |
FS_NE_LOCK_CONTROL | 0x00000010L | Fire for lock and unlock operations.
The on_notify_lock, on_notify_unlock_all, on_notify_unlock_all_by_key, and on_notify_unlock_single events will fire, as applicable, anytime the OS locks or unlocks a range of bytes in a file. |
FS_NE_CLEANUP | 0x00000020L | Fire for file handle cleanup operations.
The on_notify_cleanup_file event will fire anytime a process closes a file or directory handle. |
FS_NE_CLOSE | 0x00000040L | Fire for file close operations.
The on_notify_close_file event will fire anytime the OS closes a file or directory. |
FS_NE_CAN_DELETE | 0x00000080L | Fire for 'can be deleted' operations.
The on_notify_can_file_be_deleted event will fire anytime the OS checks whether a file or directory can be deleted. |
FS_NE_DELETE | 0x00000100L | Fire for delete operations.
The on_notify_delete_file event will fire anytime the OS deletes a file or directory. |
FS_NE_RENAME | 0x00000200L | Fire for rename/move operations.
The on_notify_rename_or_move_file event will fire anytime the OS renames or moves a file or directory. |
FS_NE_GET_SECURITY | 0x00000400L | Fire for get security operations.
The on_notify_get_file_security event will fire anytime the OS queries the security attributes of a file or directory. |
FS_NE_ENUMERATE_DIRECTORY | 0x00000800L | Fire for directory enumeration operations.
The on_notify_enumerate_directory event will fire anytime the OS retrieves a directory entry during directory enumeration. |
FS_NE_QUERY_FILE_INFO | 0x00001000L | Fire for QueryFileInformation operations.
The on_notify_query_file_info event will fire anytime the OS retrieves information about a file or directory. |
FS_NE_GET_SIZES | 0x00002000L | Fire for get size operations.
The on_notify_get_file_sizes event will fire anytime the OS retrieves a file's size information. |
FS_NE_SET_SECURITY | 0x00004000L | Fire for set security operations.
The on_notify_set_file_security event will fire anytime the OS changes the security attributes of a file or directory. |
FS_NE_SET_ATTRIBUTES | 0x00008000L | Fire for file attribute update operations.
The on_notify_set_file_attributes event will fire anytime the OS changes the attributes of a file or directory. |
FS_NE_SET_SIZES | 0x00010000L | Fire for file resize operations.
The on_notify_set_file_size event will fire anytime the OS resizes a file, and the on_notify_set_allocation_size event will fire anytime the OS changes a file's allocation size. |
FS_NE_CREATE_HARD_LINK | 0x00020000L | Fire for hard link creation operations.
The on_notify_create_hard_link event will fire anytime the OS creates a hard link. |
FS_NE_FSCTL | 0x00040000L | Fire for FSCTL operations.
The on_notify_fsctl event will fire anytime an IRP_MJ_FILE_SYSTEM_CONTROL operation occurs. |
FS_NE_IOCTL | 0x00080000L | Fire for IOCTL operations.
The on_notify_ioctl event will fire anytime an IRP_MJ_DEVICE_CONTROL operation occurs. |
FS_NE_SET_FILE_INFO | 0x00100000L | Fire for SetFileInformation operations.
The on_notify_set_file_info event will fire anytime the OS changed information about a file or directory. |
FS_NE_ALL | -1 | Fire for all filesystem operations.
Notification Events will fire for all filesystem operations. |
The filter_rule_index parameter specifies the index of the item in the array. The size of the array is controlled by the filter_rule_count property.
This property is read-only.