Who rated this post

Hi @Gorbiabimanyu 

Please check Remote Access  admin guide for Configuring SCV - Logical Sections:

The begin_and (andX) label - this label is similar to the begin_or (orX)label, but the expressions inside are evaluated and logically ANDed. The end of this section is marked by the end (andX) or the end (orX) label. As mentioned earlier, simple subsequent expressions are automatically ANDed. The reason that this label exists is to allow nested ANDed sections inside ORed sections. For example, if an administrator considers old browsers as secure since they do not have a lot of potentially unsafe components, and new browsers as secure, since they contain all the latest security patches, he can define the following SCV rules:

In your case you have incorrect start of begin_and

: (RegistryMonitor
:type (plugin)
:parameters (
:begin_and (1)
:string ("HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\CheckPoint\TRAC\client_sub_type=EndpointSecurityIntegrated"
:end (and1)
:begin_admin (admin)
:send_log (alert)
:mismatchmessage ("Please use Check point Endpoint Security Software that was provided by ********")
:end (admin)
)
)