What is the XML rule for Only match Groups that reside in the configured container/subtree?

<rule>    <description>Only match Groups that reside in the configured container/subtree</description>    <comment xml:space="preserve">This rule marks events in the given containers for processing by adding the unmached-src-dn and attempt-to-match operation properties. You can add subtrees in the ILM Vault for inclusion by adding if-src-dn conditionals here. The attempt-to-match property determines whether the matching policies following this initializing policy should try to match the object or whether its out of scope.</comment>    <conditions>        <and>            <if-class-name mode="nocase" op="equal">Group</if-class-name>            <if-src-dn op="in-subtree">~idv.dit.data.groups~</if-src-dn>          </and>      </conditions>    <actions>        <do-set-op-property name="unmatched-src-dn">            <arg-string>                <token-unmatched-src-dn convert="true"/>              </arg-string>          </do-set-op-property>        <do-set-op-property name="attempt-to-match">            <arg-string>                <token-text xml:space="preserve">true</token-text>              </arg-string>          </do-set-op-property>      </actions>  </rule>