The default_timeout is the number of seconds after which the UI will take its
default action, the default_action can be allow or deny and the
default_duration, which indicates for how long the default action should be
taken, can be once, until restart or always to persist the action as a new
rule on disk. default_operand indicates the operand type to use for
the rule, can be process.path (the path of the executable), user.id,
dest.ip, dest.host or dest.port.