Rule overlap with multiple linked audit policies

Because you can link your audit or snapshot specifications to an audit policy that may reference other audit policies, it is possible that some of the linked policies might contain the same rules but with different configuration options.

Rules become merged in audit results when you identify the same object for a rule and the only way to customize the rule is by setting options. The options may or may not be different, but they still get merged into one rule before running and there is only one result. If the options are different, the options are OR'ed together into the single rule. Examples include file rules, registry rules, metabase rules (legacy comparison type), Windows Service rules, etc.

Rules that take parameters or you specify the compliance criteria are merged if and only if the parameters and the criteria are exactly the same. Otherwise they are executed as separated rules. Examples include compliance (pluggable) rules, custom script rules, and server module based rules.