symantec-ems.rules