After choosing “Add”, you will see the deny rule settings window. In this window there are the following fields:
By default all fields are empty which implies matching any value in each field. Thus if you create a default permitting rule and apply it to a user or a group, the firewall will allow any of user's or group's communication that go through ICS CUBE. You can check what values are acceptable when you place the cursor over the field, alternatively you can choose a value from the drop-down list containing the objects that are already known to ICS CUBE.
The “Allow traffic even if the user is disabled” checkbox means that even if user has been disabled or his quota has been exceeded, he will still have access to the resources that are set in the rule.