FTP monitor (if not covered in DLP) RUle for ArcSight ESM

I don't understand how to solve this problem please anyone solved the rule